KR102452181B1 - Apparatus for sorting of approximate encrypted messages and method thereof - Google Patents

Abstract

A computing device is disclosed. The arithmetic unit includes a memory for storing a plurality of homomorphic ciphertexts for an approximate message including an error, and a processor for aligning a plurality of homomorphic ciphertexts, wherein the processor is capable of aligning five homomorphic ciphertexts in one stage. Sort multiple homomorphic ciphertexts using a way sorter.

Description

Sorting apparatus and method for approximate encrypted ciphertext

The present disclosure relates to an apparatus and method for sorting approximate encrypted cipher text, and more particularly, to an apparatus and method for efficiently performing sorting on approximate encrypted cipher text.

As communication technology develops and electronic devices become more popular, efforts to maintain communication security between electronic devices are continuously being made. Accordingly, encryption/decryption technology is used in most communication environments.

When a message encrypted by encryption technology is delivered to the other party, the other party must perform decryption in order to use the message. In this case, the counterpart wastes resources and time in the process of decrypting the encrypted data. In addition, when a third party hacks while the other party temporarily decrypts the message for operation, there is a problem that the message can be easily leaked to the third party.

To solve this problem, homomorphic encryption methods are being studied. If the homomorphic encryption method is used, even if an operation is performed on the ciphertext itself without decrypting the encrypted information, the same result as the encrypted value after operation on the plaintext can be obtained. Accordingly, various operations can be performed without decrypting the ciphertext.

In the sense that sorting is required for operations such as k-means clustering, top-k data operations, binning, and statistical analysis, sorting has recently been processed for homomorphic ciphertext. is being requested

However, the operation of homomorphic cipher text supports only limited basic operations such as addition and multiplication, and the conventionally widely used Quick sort and Merge Sort, etc. Since it consists of repetition, a sorting algorithm suitable for isomorphic ciphertext was required.

Accordingly, the present disclosure is designed to solve the above-described problems, and an object of the present disclosure is to provide an apparatus and method for efficiently performing alignment on approximate encrypted ciphertext.

The present disclosure is to achieve the above object, and the homomorphic ciphertext processing method according to an embodiment of the present disclosure includes the steps of receiving an alignment command for a plurality of homomorphic ciphertexts, and aligning five homomorphic ciphertexts in one stage sorting the plurality of isomorphic ciphertexts using a possible 5-way sorter, and outputting a sorting result.

In this case, in the aligning step, a parallel sorting process may be performed using a plurality of 5-way sorters.

Meanwhile, the 5-way sorter may perform sorting using a comparison function that selectively outputs a larger value or a smaller value among two input values.

In this case, the comparison function may be calculated by calculating a product of an approximate sign function that outputs a preset value according to magnitude comparison and an input value.

In this case, the approximation sign function is a function obtained by repeating a composition function that makes an output value close to 1 for an input value greater than 0 and an output value close to -1 for an input value less than 0 is repeated a predetermined number of times. can

In this case, the approximate sign function may be a function obtained by repeatedly calculating two different synthesis functions three times.

On the other hand, the 5-way sorter, when the first isomorphic ciphertext, the second isomorphic ciphertext and the third isomorphic ciphertext are input, using the comparison function, a larger value and a smaller value among the first isomorphic ciphertext and the second isomorphic ciphertext , output a first output value by inputting the calculated large value and the third isomorphic ciphertext to the comparison function, and inputting the calculated small value and the third isomorphic ciphertext to the comparison function to obtain a third An output value may be output, and a second output value may be calculated and output by subtracting the first output value and the third output value from the sum of the first to third homomorphic ciphertexts.

On the other hand, the 5-way sorter can expand the plaintext space of each of the five aligned homomorphic ciphertexts.

On the other hand, the computing device according to an embodiment of the present disclosure includes a memory for storing a plurality of homomorphic ciphertexts for an approximate message including an error, and a processor for arranging the plurality of homomorphic ciphertexts, wherein the processor includes five homomorphic ciphertexts. It is possible to sort the plurality of homomorphic ciphertexts using a 5-way sorter that can be sorted in one stage.

In this case, the processor may perform parallel alignment processing using a plurality of 5-way sorters.

Meanwhile, the 5-way sorter may perform sorting using a comparison function that selectively outputs a larger value or a smaller value among two input values.

In this case, the comparison function may be calculated by calculating a product of an approximate sign function that outputs a preset value according to magnitude comparison and an input value.

In this case, the approximation sign function is a function obtained by repeating a composition function that makes an output value close to 1 for an input value greater than 0 and an output value close to -1 for an input value less than 0 is repeated a predetermined number of times. can

In this case, the approximate sign function may be a function obtained by repeatedly calculating two different synthesis functions three times.

On the other hand, the 5-way sorter, when the first isomorphic ciphertext, the second isomorphic ciphertext and the third isomorphic ciphertext are input, using the comparison function, a larger value and a smaller value among the first isomorphic ciphertext and the second isomorphic ciphertext , output a first output value by inputting the calculated large value and the third isomorphic ciphertext to the comparison function, and inputting the calculated small value and the third isomorphic ciphertext to the comparison function to obtain a third An output value may be output, and a second output value may be calculated and output by subtracting the first output value and the third output value from the sum of the first to third homomorphic ciphertexts.

On the other hand, the 5-way sorter can expand the plaintext space of each of the five aligned homomorphic ciphertexts.

On the other hand, in a computer-readable recording medium including a program for executing a method for processing a homomorphic ciphertext according to an embodiment of the present disclosure, the processing method for a homomorphic ciphertext receives an alignment command for a plurality of isomorphic ciphertexts and aligning the plurality of homomorphic ciphertexts using a 5-way sorter capable of sorting five homomorphic ciphertexts in one stage.

According to various embodiments of the present disclosure as described above, sorting can be performed on a large amount of homomorphic ciphertexts, and in that a 5-way sorter that compares five homomorphic ciphertexts in one stage is used, sorting with a low number of stages can perform faster sorting.

1 is a diagram for explaining the structure of a network system according to an embodiment of the present disclosure;
2 is a block diagram showing the configuration of a computing device according to an embodiment of the present disclosure;
3 is a view for explaining the alignment operation of the computing device of the present disclosure;
4 and 5 are diagrams showing the form of various synthesis functions related to a sign function;
6 is a diagram for explaining the sorting operation for a large amount of homomorphic ciphertext;
7 is a diagram for explaining the sorting operation for three homomorphic ciphertexts;
8 is a diagram for explaining the sorting operation for four homomorphic ciphertexts;
9 is a diagram for explaining the sorting operation for five homomorphic ciphertexts, and,
10 is a flowchart illustrating a ciphertext calculation method according to an embodiment of the present disclosure.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings. Encryption/decryption may be applied as necessary to the information (data) transmission process performed in the present disclosure, and the expressions describing the information (data) transmission process in the present disclosure and claims are all encrypted/decrypted, even if not separately mentioned. It should be construed as including cases. In the present disclosure, an expression of a form such as "transfer from A to B (transfer)" or "A receives from B" includes transmission (transmission) or reception with another medium included in the middle, and must be from A to B It does not represent only direct transmission (delivery) or reception.

In the description of the present disclosure, the order of each step should be understood as non-limiting unless the preceding step must be logically and temporally performed before the subsequent step. That is, except for the above exceptional cases, even if the process described as the subsequent step is performed before the process described as the preceding step, the essence of the disclosure is not affected, and the scope of rights should also be defined regardless of the order of the steps. And, in the present specification, "A or B" is defined as meaning not only selectively pointing to any one of A and B, but also including both A and B. In addition, in the present disclosure, the term “comprising” has the meaning of encompassing the inclusion of other components in addition to the elements listed as being included.

In the present disclosure, only essential components necessary for the description of the present disclosure are described, and components not related to the essence of the present disclosure are not mentioned. And it should not be construed as an exclusive meaning including only the mentioned components, but should be construed as a non-exclusive meaning that may also include other components.

And, in the present disclosure, "value" is defined as a concept including a vector as well as a scalar value.

The mathematical operation and calculation of each step of the present disclosure to be described later may be implemented as a computer operation by a known coding method for performing the corresponding operation or calculation and/or coding suitable for the present disclosure.

The specific equations described below are illustratively described among possible alternatives, and the scope of the present disclosure should not be construed as being limited to the equations mentioned in the present disclosure.

For convenience of description, in the present disclosure, the notation is determined as follows.

a ← D : Select element (a) according to distribution (D)

s1, s2 ∈ R : Each of S1 and S2 is an element belonging to the set R.

mod(q) : Modular operation with q elements

: 내부 값을 반올림함

: rounds the internal value

Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a configuration of a network system according to an embodiment of the present disclosure.

Referring to FIG. 1 , a network system may include a plurality of electronic devices 100-1 to 100-n, a first server device 200, and a second server device 300, and each configuration includes a network 10 ) can be connected to each other.

The network 10 may be implemented as various types of wired and wireless communication networks, broadcast communication networks, optical communication networks, cloud networks, etc., and each device may be connected in a manner such as Wi-Fi, Bluetooth, NFC (Near Field Communication), etc. without a separate medium. may be

Although FIG. 1 illustrates that there are a plurality of electronic devices (100-1 to 100-n), a plurality of electronic devices is not necessarily used, and one device may be used. For example, the electronic devices 100-1 to 100-n may be implemented as various types of devices such as smartphones, tablets, game players, PCs, laptop PCs, home servers, kiosks, etc. It can also be implemented in the form of home appliances.

The user may input various information through the electronic devices 100-1 to 100-n used by the user. The input information may be stored in the electronic devices 100-1 to 100-n itself, or may be transmitted to and stored in an external device for reasons such as storage capacity and security. In FIG. 1 , the first server device 200 serves to store such information, and the second server device 300 may serve to use some or all of the information stored in the first server device 200 . have.

Each of the electronic devices 100 - 1 to 100 - n may homomorphically encrypt the input information and transmit the same type ciphertext to the first server device 200 .

Each of the electronic devices 100-1 to 100-n may include encryption noise, that is, an error, calculated in the process of performing homomorphic encryption, in the ciphertext. Specifically, the homomorphic cipher text generated by each electronic device 100-1 to 100-n may be generated in a form in which a result value including a message and an error value is restored when it is later decrypted using a secret key. have.

For example, the homomorphic ciphertext generated by the electronic devices 100-1 to 100-n may be generated in a form satisfying the following properties when it is decrypted using a secret key.

[Equation 1]

Dec(ct, sk) = <ct, sk> = M+e(mod q)

Here, < , > denotes a normal inner product, ct denotes a ciphertext, sk denotes a private key, M denotes a plaintext message, e denotes an encryption error value, and mod q denotes the modulus of the ciphertext. q should be chosen to be greater than the value M of the message multiplied by the scaling factor (Δ). If the absolute value of the error value e is sufficiently small compared to M, the decryption value M+e of the ciphertext is a value that can replace the original message with the same precision in the significant-digit operation. Among the decoded data, an error may be disposed on the least significant bit (LSB) side, and M may be disposed on the least significant bit side.

If the size of the message is too small or too large, the size may be adjusted using a scaling factor. When the scaling factor is used, not only integer messages but also real number messages can be encrypted, so that usability can be greatly increased. In addition, by adjusting the size of the message by using the scaling factor, the size of the area in which messages exist in the ciphertext after the operation is performed, that is, the size of the effective area can also be adjusted.

According to an embodiment, the ciphertext modulus q may be set and used in various forms. As an example, the modulus of the ciphertext may be set in the form of an exponential power q= ^ΔL of the scaling factor Δ. If Δ is 2, it may be set to a value such as q=2 ¹⁰ .

The first server device 200 may store the received homomorphic ciphertext as an ciphertext without decrypting it.

The second server device 300 may request a specific processing result for the homomorphic ciphertext from the first server device 200 . The first server device 200 may perform a specific operation according to the request of the second server device 300 , and then transmit the result to the second server device 300 .

For example, when the cipher texts ct1 and ct2 transmitted by the two electronic devices 100 - 1 and 100 - 2 are stored in the first server device 200 , the second server device 300 transmits the two electronic devices 100 - 1 , 100-2) may request a value obtained by adding up information provided from the first server device 200 . The first server device 200 may perform an operation for summing two ciphertexts according to a request, and then transmit the result value (ct1 + ct2) to the second server device 300 .

Due to the nature of the homomorphic ciphertext, the first server device 200 may perform the operation without decryption, and the result value is also in the form of the ciphertext. In the present disclosure, a result value obtained by an operation is referred to as an operation result ciphertext.

The first server device 200 may transmit the operation result ciphertext to the second server device 300 . The second server device 300 may decrypt the received operation result ciphertext to obtain operation result values of data included in each homomorphic ciphertext.

The operation on the homomorphic ciphertext may be a comparison operation such as calculating a maximum value, calculating a minimum value, and comparing a size, as well as an expression consisting of addition, subtraction, and multiplication. Also, it may be an alignment for a plurality of homomorphic ciphertexts using a comparison operation. As described above, the first server device 200 may be referred to as a computing device in that it can perform a calculation operation. A specific alignment method will be described later with reference to FIG. 3 .

And, when the weight of the approximate message exceeds the threshold, the first server device 200 may perform a rebooting operation. The reboot operation will be described later with reference to FIG. 3 .

Meanwhile, although FIG. 1 illustrates a case in which encryption is performed by the first electronic device and the second electronic device and decryption is performed by the second server device, the present invention is not limited thereto.

2 is a block diagram illustrating a configuration of a computing device according to an embodiment of the present disclosure.

Specifically, in the system of FIG. 1, a device for performing homomorphic encryption such as a first electronic device and a second electronic device, a device for calculating an isomorphic ciphertext such as a first server device, etc. A device or the like may be referred to as a computing device. The computing device may be various devices such as a personal computer (PC), a notebook computer, a smart phone, a tablet, and a server.

Referring to FIG. 2 , the computing device 400 may include a communication device 410 , a memory 420 , a display 430 , a manipulation input device 440 , and a processor 450 .

The communication device 410 is formed to connect the computing device 400 with an external device (not shown), and is connected to an external device through a local area network (LAN) and an Internet network, as well as a USB ( Universal Serial Bus) port or wireless communication (eg, WiFi 802.11a/b/g/n, NFC, Bluetooth) port may be connected through the port. Such a communication device 410 may also be referred to as a transceiver.

The communication device 410 may receive the public key from the external device, and may transmit the public key generated by the computing device 400 itself to the external device.

In addition, the communication device 410 may receive a message from the external device and transmit the generated homomorphic cipher text to the external device. Also, the communication device 410 may receive a homomorphic ciphertext from an external device.

In addition, the communication device 410 may receive various parameters necessary for generating a ciphertext from an external device. Meanwhile, in implementation, various parameters may be directly input from the user through the manipulation input device 440 to be described later.

Also, the communication device 410 may receive a request for an operation on the homomorphic ciphertext from the external device, and may transmit the calculated result to the external device. Here, the requested operation may be an operation such as addition, subtraction, and multiplication, a comparison operation that is a non-polynomial operation, or an alignment processing.

At least one instruction related to the computing device 400 may be stored in the memory 420 . Specifically, various programs (or software) for operating the computing device 400 according to various embodiments of the present disclosure may be stored in the memory 420 .

The memory 420 may be implemented in various forms such as RAM, ROM, flash memory, HDD, external memory, memory card, and the like, but is not limited thereto.

The memory 420 may store a message to be encrypted. Here, the message may be various types of credit information and personal information cited by the user, and may be information related to a usage history, such as location information used in the computing device 400 , Internet use time information, and the like.

In addition, the memory 420 may store the public key, and when the computing device 400 is a device that directly generates the public key, it may store not only the private key but also the public key and various parameters necessary for generating the private key.

In addition, the memory 420 may store the isomorphic ciphertext generated in the process described below. In addition, the memory 420 may store the same type cipher text transmitted from the external device. Also, the memory 420 may store an operation result ciphertext that is a result of an operation process to be described later.

The display 430 displays a user interface window for receiving a selection of a function supported by the computing device 400 . Specifically, the display 430 may display a user interface window for selecting various functions provided by the computing device 400 . The display 430 may be a monitor such as a liquid crystal display (LCD), organic light emitting diodes (OLED), etc., and may be implemented as a touch screen capable of simultaneously performing the functions of the manipulation input device 440 to be described later. .

The display 430 may display a message requesting input of parameters necessary for generating a private key and a public key. In addition, the display 430 may display a message in which the encryption target selects a message. Meanwhile, in implementation, the encryption target may be directly selected by the user or may be automatically selected. That is, personal information that requires encryption may be automatically set even if the user does not directly select a message.

The manipulation input device 440 may receive a function selection of the arithmetic device 400 and a control command for the corresponding function input from the user. Specifically, the manipulation input device 440 may receive parameters necessary for generating a private key and a public key from a user. Also, the manipulation input device 440 may receive a message to be encrypted from the user.

In addition, the manipulation input device 440 may receive an alignment command or select a homomorphic ciphertext to be aligned.

The processor 450 controls the overall operation of the computing device 400 . Specifically, the processor 450 may control the overall operation of the computing device 400 by executing at least one instruction stored in the memory 420 . The processor 450 may be configured as a single device such as a central processing unit (CPU) and an application-specific integrated circuit (ASIC), or may include a plurality of devices such as a CPU and a graphics processing unit (GPU).

When a message to be transmitted is input, the processor 450 may store it in the memory 420 . In addition, the processor 450 may homogeneously encrypt the message by using various setting values and programs stored in the memory 420 . In this case, a public key may be used.

The processor 450 may generate and use the public key required to perform encryption by itself, or may receive and use the public key from an external device. For example, the second server device 300 performing decryption may distribute the public key to other devices.

When generating a key by itself, the processor 450 may generate a public key using the Ring-LWE technique. More specifically, the processor 450 may first set various parameters and rings and store them in the memory 420 . Examples of parameters may include the length of a plaintext message bit, the size of a public key and a private key, and the like.

The ring may be expressed by the following equation.

[Equation 2]

where R is a ring, Zq is a coefficient, and f(x) is an nth-order polynomial.

A ring is a set of polynomials having preset coefficients, and means a set in which addition and multiplication are defined between elements and closed to addition and multiplication. Such a ring may be referred to as a ring.

For example, the ring means a set of nth-order polynomials having a coefficient Zq. Specifically, when n is Φ(N), it means an N-th cyclotomic polynomial. (f(x)) represents the ideal of Zq[x] generated by f(x). The Euler totient function Φ(N) means the number of natural numbers that are mutually prime with N and smaller than N. If Φ _N (x) is defined as an Nth-order cyclotonic polynomial, the ring can also be expressed as the following Equation (3).

[Equation 3]

The secret key sk can be expressed as follows.

On the other hand, the ring of Equation 3 described above has a complex number in the plaintext space. Meanwhile, in order to improve the operation speed for homomorphic ciphertext, only a set in which the plaintext space is a real number among the set of rings described above may be used.

When such a ring is set, the processor 450 may calculate a secret key sk from the ring.

[Equation 4]

Here, s(x) denotes a polynomial randomly generated with small coefficients.

Then, the processor 450 calculates a first random polynomial (a(x)) from the ring. The first random polynomial can be expressed as follows.

[Equation 5]

Also, the processor 450 may calculate an error. Specifically, the processor 450 may extract an error from a discrete Gaussian distribution or a distribution having a close statistical distance thereto. This error can be expressed as follows.

[Equation 6]

If the error is calculated, the processor 450 may calculate the second random polynomial by modularly calculating the error on the first random polynomial and the secret key. The second random polynomial can be expressed as follows.

[Equation 7]

Finally, the public key pk is set in a form including the first random polynomial and the second random polynomial as follows.

[Equation 8]

Since the above-described method for generating a key is only an example, the present invention is not necessarily limited thereto, and it goes without saying that the public key and the private key may be generated by other methods.

Meanwhile, when the public key is generated, the processor 450 may control the communication device 410 to transmit the generated public key to other devices.

In addition, the processor 450 may generate a homomorphic cipher text for the message. In this case, the processor 450 may perform an encoding operation of converting the message into a polynomial in advance.

와, 다음과 같은 수학식 9를 이용하여 암호문을 생성할 수 있다. And the processor 450 is a public key in the message converted to the message form.

And, it is possible to generate a ciphertext using Equation 9 as follows.

[Equation 9]

In this case, the processor 450 may generate the length of the cipher text to correspond to the size of the scaling factor.

The message to be encrypted may be received from an external source or may be input from an input device directly provided or connected to the computing device 400 . Also, the scaling factor may be directly input by the user or may be provided through another device. For example, when the computing device 400 includes a touch screen or a keypad, the processor 450 stores data input by the user through the touch screen or the keypad in the memory 420 and then encrypts it. have.

Meanwhile, according to an embodiment of the present disclosure, packing may be performed. If packing is used in homomorphic encryption, it becomes possible to encrypt multiple messages with a single ciphertext. In this case, when the operation device 400 performs an operation between each ciphertext, as a result, operations on a plurality of messages are processed in parallel, thereby greatly reducing the operation burden.

Specifically, when a message consists of a plurality of message vectors, the processor 450 converts the plurality of message vectors into a polynomial in a form that can be encrypted in parallel, and then multiplies the polynomial by a scaling factor and generates a public key. It can also be used for homomorphic encryption. Accordingly, the processor 450 may generate a ciphertext in which a plurality of message vectors are packed.

In addition, when decryption of the homomorphic ciphertext is required, the processor 450 may generate a polynomial-type decrypted text by applying a secret key to the isomorphic ciphertext, and may generate an approximate message by decoding the polynomial-type decrypted text. In this case, the generated approximation message may include an error as described in Equation 1 described above.

And the processor 450 may perform an operation on the ciphertext. Specifically, the processor 450 may perform an operation such as addition, subtraction, or multiplication while maintaining an encrypted state with respect to the homomorphic ciphertext.

Also, the processor 450 may perform an operation on a polynomial having an operation other than addition, subtraction, or multiplication on the ciphertext. Specifically, the homomorphic ciphertext is closed for addition, subtraction, and multiplication, but is not closed for other operations. Therefore, for operations other than addition, subtraction, and multiplication, an approximate expression expressed by the above-described three operations should be used. Here, the approximation expression may use well-structured polynomials that are well-structured to have low complexity, that is, a synthesis function.

In addition, the processor 450 may align a plurality of homomorphic ciphertexts. Specifically, the processor 450 may perform sorting on a plurality of isomorphic ciphertexts using a 5-way sorter. In this case, the processor 450 may perform the above-described sorting operation in parallel using a plurality of 5-way sorters. A detailed operation and configuration of the 5-way aligner will be described below with reference to FIG. 3 .

In addition, when the operation is completed, the processor 450 may detect data of the effective area from the operation result data. Specifically, the processor 450 may perform a reboot operation on the ciphertext when the weight of the approximate message in the ciphertext exceeds the threshold as a result of the operation.

3 is a diagram for explaining an alignment operation of the arithmetic device of the present disclosure.

Referring to FIG. 3 , a 5-way aligner 500 is disclosed. This 5-way sorter 500 can align five homomorphic ciphertexts in one stage.

Such a 5-way sorter 500 can align two to four homomorphic ciphertexts using one stage. Hereinafter, in order to facilitate the description, the sorting operation for two homomorphic ciphertexts will be first described, and the sorting method for 3 to 5 homomorphic ciphertexts will be described later with reference to FIGS. 7 to 9 .

First, an arrangement method of two homomorphic ciphertexts will be described.

When the first homomorphic ciphertext and the second homomorphic ciphertext are input, the 5-way sorter 500 outputs the isomorphic ciphertext having a larger value among the two homomorphic ciphertexts as the first output value, and removes the homomorphic ciphertext having a small value. 2 Output values can be output.

For such alignment, it is necessary to compare two homomorphic ciphertexts in advance. In the present disclosure, an approximate sign function is used, and the comparison function is implemented by the operation of the approximate sign function and the product of two input values. The approximate sign function may be expressed as Equation 10, and the comparison function may be expressed as Equation 11.

[Equation 10]

Here, a and b are homomorphic ciphertexts.

[Equation 11]

L _a>b (a, b) = (a > b) a + (a < b) b

Here, L _a>b (a, b) is a comparison function that outputs the larger value among the two input homomorphic ciphers (a, b). For example, you can return a if a > b and return b if a < b. And the approximate sign function (a > b) is a sign function that calculates the same value as in Equation 10 according to the comparison of homomorphic ciphertexts.

And the larger value and the smaller value of the two values can be calculated as max(a, b) and min(a, b). Each of max(a, b) and min(a, b) uses the above-described approximate sign function It can be expressed using

[Equation 12]

max(a, b) = (a > b) a + (a < b) b

min(a, b) = (a > b) b + (a < b) a

Here, it can be seen that max(a, b) is the same as the above-described comparison function. In addition, the minimum value may be calculated by calculating the output value of max(a, b) and the input values without using a comparison function. A function that simultaneously outputs the maximum value and the minimum value among two values through this operation can be expressed as follows.

[Equation 13]

LT _(a>b) (a, b) = (L _a>b (a, b), a + b - L _a>b (a, b))

Here, LT _(a>b) (a, b) is a function that simultaneously outputs the maximum value and the minimum value among the two values.

On the other hand, the sign function is a non-polynomial operation that cannot be expressed by addition, subtraction, and multiplication. Therefore, in the present disclosure, in order to apply the sign function to the homomorphic ciphertext, an approximate sign function is used.

For example, various forms of the approximate sign function may be used. In the present disclosure, a well-structured composition function with low complexity is used. The composition function used here is a composition function (f(x)) that makes the output value of the function at a non-zero input value horizontal, that is, for an input value greater than 0, the output value approaches 1, It may be a composition function that makes the output value close to -1), or a composition function that makes the output value of the function horizontal at a non-zero input value (g(x)).

Examples of the above-described two synthesis functions f(x) and g(x) are shown in Equation 14.

[Equation 14]

f ₃ (x) = (35x - 35x ³ + 21x ⁵ - 5x ⁷ )/2 ⁴

g ₃ (x) = (4589x - 16577x ³ + 25614x ⁵ - 12860x ⁷ )/2 ¹⁰

In implementation, the approximate sign function may be implemented by repeatedly applying the above-described f(x) and g(x) a plurality of times. The form of the approximate sign function used in the present disclosure will be described later with reference to FIGS. 4 and 5 .

As such, the 5-way sorter 500 of the present disclosure may perform sorting with an approximate sign function implemented as the above-described synthesis function. The sorting operation for three or more homomorphic ciphertexts will be described later with reference to FIGS. 7, 8, and 9. Hereinafter, not using a 2-way sorter, but using a 5-way sorter to sort a large amount of homomorphic ciphertext. explain about

The main technical feature of the present disclosure is to reduce overhead in the process of performing sorting on a plurality of homomorphic ciphertexts.

번의 비교가 요구된다. First, in the sorter, all comparison operations between comparison objects must be performed, but it is possible to sort input data. For example, in the condition that a > b and a > c, if there is no comparison condition between b and c, a, b, and c cannot be sorted. Therefore, for sorting of k homomorphic ciphertexts,

comparison is required.

번 만큼이 소요된다. 즉, 비교를 병렬로 진행할 수 있는 경우에, 비교 연산에서 필요한 회수는

이다. If SIMD (Single Instruction, Multiple Data) is applied, the comparison with k slots is

times it takes That is, if the comparison can be performed in parallel, the number of times required in the comparison operation is

to be.

On the other hand, various arithmetic processing is performed during the comparison operation for the homomorphic ciphertext, and the operation that takes the most time during the sort operation is the reboot operation. Therefore, if the reboot operation can be processed in parallel, the difference between the time required for two comparison operations and the time required for one comparison operation is not large.

=2인바, k는 5가 된다. 이에 따라 본 개시에서는 한 스테이지에서 5개의 동형 암호문을 비교하는 5-way 정렬기를 이용한다. In consideration of this point, the present disclosure enables two rebooting operations to be performed at once, and accordingly, the number of times required in the above-described comparison operation.

= 2, so k becomes 5. Accordingly, the present disclosure uses a 5-way sorter that compares five homomorphic ciphertexts in one stage.

Hereinafter, the reason why two rebooting operations can be performed at once will be briefly described.

If bootstrapping is required for two ciphertexts (ct ₁ , ct ₂ ), the second ciphertext (ct ₂ ) is multiplied by i, and the second ciphertext (ct ₂ ) obtained by multiplying the first ciphertext (ct ₁ ) by i by i In addition, one ciphertext (c = c ₁ + i c ₂ ) can be produced.

Thereafter, a reboot operation may be performed for the summed value (c = c ₁ + i c ₂ ), and the reboot value (c ₁ ) for the first ciphertext and the second ciphertext may be performed through the operation as in Equation 15 above. A reboot value (c ₂ ) can be calculated for .

[Equation 15]

As such, the homomorphic ciphertext has a real part and an imaginary part, and the two homomorphic ciphertexts can be performed through a single reboot operation by taking the fact that the actual value is located in the real part.

And since it is possible to sort 5 homomorphic ciphertexts at once in this way, the total number of stages can be reduced compared to the case of aligning two homomorphic ciphertexts at once.

When the input data is n = k ^m , the number of stages required for sorting (N _n,k ) is as follows.

[Equation 16]

For example, if a case where k is 2 and a case where k is 5 is compared, the stage ratio in each case is as follows.

[Equation 17]

As such, when the input data is large enough, the total number of stages can be reduced by 44% by using a 5-way sorter rather than using a 2-way sorter.

As described above, the 5-way sorter of the present disclosure performs the sorting operation through the polynomial operation between the above-described synthesis function and the input function.

On the other hand, each homomorphic ciphertext 10, 20, 30, 40, 50 may include approximate message areas 11, 21, 31, 41, 51, respectively. Messages and errors (m1+e1, m2+e2, m3+e3, m4+e4, m5+e5) are included in the approximate message areas 11, 21, 31, 41, and 51 together.

Therefore, if the operation is repeated through the sorting operation, the approximate message area of the homomorphic ciphertext increases and the remaining plaintext space decreases.

If the operation needs to be performed even after sorting, or if the plaintext space becomes smaller than the limit value during the computation process for performing the sorting, the 5-way sorter 500 may perform a reboot operation for each homomorphic ciphertext. .

On the other hand, although the illustrated example shows that the rebooting operation is performed after the sorting operation, in implementation, the above-described rebooting operation may be performed in the 5-way sorter.

4 and 5 are diagrams illustrating the types of various synthesis functions related to a sign function. Specifically, FIG. 4 is a diagram illustrating f(x) and g(x), and FIG. 5 is a diagram illustrating a synthesis function combining f(x) and g(x).

Referring to FIG. 4 , it can be confirmed that f(x) has a small inclination although the error at the end is small. And it can be seen that g(x) has a larger slope than f(x), but an error occurs at both ends. Therefore, in the case of using the g(x) composition function in the initial stage and the composition function of f(x) in the latter stage, that is, if the combined composition function used in the same way as in FIG. 5 is used, only one composition function is used. It can have an ideal shape than a more equal number of repetitions.

Meanwhile, the above-described orders of g(x) and f(x) may be n. However, since the leading coefficients of f4 (= 35/128) and g4 (= 46623/1024) are positive, the composition of f4 and g4'S may be different if the absolute value of the input x is greater than 1. For example, if the input x is close to 1, the appended error can branch the comparison result, resulting in erroneous output.

Accordingly, in the present disclosure, 3, which is an optimal value among odd values, not even values, is used for n. The operation for (x > y) can be calculated by the following Equation 18 by the given number of iterations df and dg.

[Equation 18]

where f ^(d) is f○f○f... ○f It means to perform D times.

정확도에 대응하여 비교적 낮은

또는

복잡도(complexity)로 부호 함수를 근사할 수 있게 된다. By using a composition function like this, i.e. a well-structured polynomial,

Corresponding to the accuracy, relatively low

or

It is possible to approximate the sign function with complexity.

6 is a diagram for explaining the sorting operation for a large amount of homomorphic ciphertext. Specifically, it is a diagram for explaining a 5-way sorting method for 5 ² pieces of data.

Referring to FIG. 6 , each line represents a 5-way sorter, and dots on each line represent input values of the 5-way sorter. The five arrows on the left are the main stage for aligning the five neighboring ciphertexts, and the arrows on the right indicate the sorting direction from minimum to maximum.

The 5-way sorting algorithm arranges a 5 ^m long matrix for a random value (m) by iteratively merging 5 sorted arrays of 5 ^{i -1} length and simultaneously applying them to create an ordered array of length 5 i can do.

This 5-way algorithm can operate not only as a 5-way sorter, but also as a 2-way sorter, a 3-way sorter, and a 4-way sorter. Alignment of two homomorphic ciphertexts has been described with reference to FIG. 3 of the image, and an alignment method of 3 to 5 homomorphic ciphertexts will be described later with reference to FIGS. 7 to 9 .

For example, for m=2, 5 for ² homomorphic ciphertexts As shown in the figure, sorting can be performed by using five 5-way sorters in parallel.

7 is a diagram for explaining the sorting operation for three homomorphic ciphertexts.

Referring to FIG. 7 , the 5-way sorter 500 uses the LT comparison function when the first to third isomorphic ciphertexts (a, b, c) are input to the first isomorphic ciphertext (a) and the second A large value (max) and a small value (min) of the homomorphic ciphertext (b) can be calculated.

Thereafter, the 5-way sorter 500 may input the calculated large value (max) and the third isomorphic ciphertext (c) to calculate the largest value (w1) among the three.

In addition, the 5-way sorter 500 may input the calculated small value (min) and the third isomorphic ciphertext (c) into the comparison function to calculate the smallest value (w3) among the three.

And the 5-way sorter 500 may calculate the intermediate value w2 through the operation (w2 = a + b + c - w1 - w3).

Through this operation operation, the 5-way sorter 500 aligns the input three isomorphic ciphertexts (a, b, c) and sets each of the largest value, the median value, and the smallest value to the first output value (w1) , the second output value w2, and the third output value w3 may be output.

8 is a diagram for explaining an alignment operation for four homomorphic ciphertexts.

Referring to Figure 8, the 5-way sorter 500, when the first to fourth homomorphic ciphertexts (a, b, c, d) are input, first divides the four ciphertexts into two groups, and compares within each group You can do the action first.

Specifically, the 5-way sorter 500 calculates a large value (max1) and a small value (min1) for the first isomorphic ciphertext (a) and the second isomorphic ciphertext (b) in group A using the LT comparison function. can be calculated.

And the 5-way sorter 500 can calculate the large value (max2) and the small value (min2) among the third isomorphic ciphertext (c) and the second isomorphic ciphertext (d) in group B using the LT comparison function. have.

And the 5-way sorter 500 calculates the smaller value (x1) of the large value (max1) of group A and the small value (min2) of group B, and the small value (min1) of group A and the large value of group B A smaller value x2 among the values max2 may be calculated.

Thereafter, the 5-way sorter 500 may calculate the largest value w1 by comparing the calculated large values max1 and max2 of each group.

And the 5-way sorter 500 may calculate a second large value (w2) by comparing the calculated small values (x1, x2).

And the 5-way sorter 500 may calculate the smallest value (w4) by comparing the calculated small values (min1, min2) of each group.

And the 5-way sorter 500 may calculate the third large value w3 through the operation (w3 = a + b + c + d - w1 - w2 - w4).

Through this operation operation, the 5-way sorter 500 aligns the input four isomorphic ciphertexts (a, b, c, d) and sets each of the largest value, the second value, the third value, and the smallest value to the first The output may be performed as the output value w1 , the second output value w2 , the third output value w3 , and the fourth output value w4 .

9 is a diagram for explaining the sorting operation for five homomorphic ciphertexts.

Referring to FIG. 9 , the 5-way sorter 500 divides the first to fifth homomorphic ciphertexts (a, b, c, d, e) into two groups, A comparison operation for each group may be performed first.

For example, the 5-way sorter 500 uses a 3-way sorting method for the first to third homomorphic ciphertexts (a, b, c) in the group A using a large value (max1), a medium value (mid1) ), a small value (min1) can be calculated.

And the 5-way sorter 500 may calculate a large value (max2) and a small value (min2) for the fourth and fifth homomorphic ciphertexts (d, e) using the LT comparison function.

And the 5-way sorter 500 calculates the smaller value (x1) among the large value (max1) of group A and the small value (min2) of group B in order to determine the second largest number, and the middle of group A The smaller value (x2) of the value (mid1) and the larger value (max2) of group B can be calculated.

In addition, the 5-way sorter 500 selects the larger value (y1) of the small value (min1) of group A and the large value (max2) of group B in order to determine the second smallest number (the fourth largest number). is calculated, and a larger value (y2) of the middle value (mid1) of the group A and the small value (min2) of the group B may be calculated.

Thereafter, the 5-way sorter 500 may calculate the largest value w1 by comparing the large values max1 and max2 of each group.

In addition, the 5-way sorter 500 may calculate a second large value w2 by comparing the calculated two small values (x1, x2).

In addition, the 5-way aligner 500 may calculate a second small value w4 by comparing the calculated two large values y1 and y2.

And the 5-way sorter 500 may calculate the smallest value (w5) by comparing the small values (min1, min2) of each group.

And the 5-way sorter 500 may calculate the third output value w3 through the operation (w3 = a + b + c + d + e - w1 - w2 - w4 - w5).

Through this operation operation, the 5-way sorter 500 aligns the input five isomorphic ciphertexts (a, b, c, d, e) with the largest value, the second value, the third value, the fourth value, and the smallest Each of the values may be output as a first output value w1 , a second output value w2 , a third output value w3 , a fourth output value w4 , and a fifth output value w5 .

On the other hand, the alignment algorithm shown and described in FIGS. 7 to 9 is not an example, and other methods may be used.

10 is a flowchart illustrating a ciphertext calculation method according to an embodiment of the present disclosure.

Referring to FIG. 10 , an alignment command for a plurality of homomorphic cipher texts is received ( S1010 ). For example, the plurality of homomorphic ciphertexts may be ciphertexts satisfying Equation 1 described above.

And a plurality of homomorphic ciphertexts are aligned using a 5-way sorter capable of aligning five homomorphic ciphertexts in one stage (S1020). At this time, when there are six or more isomorphic ciphertexts, parallel sorting may be performed using a plurality of 5-way sorters. Here, the 5-way sorter may perform sorting using a comparison function that selectively outputs a larger value or a smaller value among two input values.

Then, an alignment result is output (S1030). For example, when a plurality of homomorphic ciphertexts are received from the external device, the sorted results may be transmitted to the external device in the sort order. Conversely, in the case of sorting for a plurality of pre-stored homomorphic ciphertexts, the storage order will be sorted through the above-described sorting operation, and the above-described output operation may be omitted.

As described above, in the homomorphic ciphertext processing method according to the present embodiment, it is possible to not only sort a large amount of isomorphic ciphertexts, but also perform sorting faster than performing sorting on a plurality of homomorphic ciphertexts with fewer stages.

Since the detailed operation of each step has been described above, a detailed description thereof will be omitted.

Meanwhile, the above-described methods according to various embodiments of the present disclosure may be implemented in the form of applications that can be installed in an existing computing device (or electronic device).

In addition, the above-described methods according to various embodiments of the present disclosure may be implemented only by software upgrade or hardware upgrade of an existing computing device (or electronic device).

In addition, various embodiments of the present disclosure described above may be performed through an embedded server provided in the computing device or at least one external server of the computing device.

Meanwhile, according to a temporary example of the present disclosure, the various embodiments described above may be implemented as software including instructions stored in a machine-readable storage media readable by a machine (eg, a computer). The device is a device capable of calling a stored instruction from a storage medium and operating according to the called instruction, and may include a display device according to the disclosed embodiments. When the instruction is executed by the processor, the processor directly , or other components under the control of the processor to perform a function corresponding to the instruction. The instruction may include code generated or executed by a compiler or an interpreter. A machine-readable storage medium includes: It may be provided in the form of a non-transitory storage medium, where 'non-transitory' means that the storage medium does not include a signal and is tangible, but data is semi-permanent in the storage medium or temporarily stored.

In addition, according to an embodiment of the present disclosure, the method according to the various embodiments described above may be provided by being included in a computer program product. Computer program products may be traded between sellers and buyers as commodities. The computer program product may be distributed in the form of a machine-readable storage medium (eg, compact disc read only memory (CD-ROM)) or online through an application store (eg, Play Store™). In the case of online distribution, at least a portion of the computer program product may be temporarily stored or temporarily generated in a storage medium such as a memory of a server of a manufacturer, a server of an application store, or a relay server.

In addition, according to an embodiment of the present disclosure, the various embodiments described above are stored in a recording medium readable by a computer or a similar device using software, hardware, or a combination thereof. can be implemented in In some cases, the embodiments described herein may be implemented by the processor itself. According to the software implementation, embodiments such as the procedures and functions described in this specification may be implemented as separate software modules. Each of the software modules may perform one or more functions and operations described herein.

Meanwhile, computer instructions for performing the processing operation of the device according to the above-described various embodiments may be stored in a non-transitory computer-readable medium. When the computer instructions stored in the non-transitory computer-readable medium are executed by the processor of the specific device, the specific device performs the processing operation in the device according to the various embodiments described above.

The non-transitory computer-readable medium refers to a medium that stores data semi-permanently, rather than a medium that stores data for a short moment, such as a register, cache, memory, etc., and can be read by a device. Specific examples of the non-transitory computer-readable medium may include a CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM, and the like.

In addition, each of the components (eg, a module or a program) according to the above-described various embodiments may be composed of a single or a plurality of entities, and some sub-components of the aforementioned sub-components may be omitted, or other sub-components may be omitted. Components may be further included in various embodiments. Alternatively or additionally, some components (eg, a module or a program) may be integrated into a single entity to perform the same or similar functions performed by each corresponding component prior to integration. According to various embodiments, operations performed by a module, program, or other component may be sequentially, parallel, repetitively or heuristically executed, or at least some operations may be executed in a different order, omitted, or other operations may be added. can

In the above, preferred embodiments of the present disclosure have been illustrated and described, but the present disclosure is not limited to the specific embodiments described above, and is commonly used in the technical field pertaining to the present disclosure without departing from the gist of the present disclosure as claimed in the claims. Various modifications may be made by those having the knowledge of

100: electronic device 200: first server device
300: second server device 400: arithmetic unit
410: communication device 420: memory
430: display 440: operation input device
450: processor

Claims (17)

receiving an alignment command for a plurality of homomorphic ciphertexts;
aligning the plurality of homomorphic ciphertexts using a 5-way sorter capable of aligning five homomorphic ciphertexts in one stage; and
Including; outputting the sort result;
The 5-way aligner,
A homomorphic ciphertext processing method in which sorting is performed using a comparison function that selectively outputs the larger or smaller value among two input values. The method of claim 1,
The sorting step is
A homomorphic ciphertext processing method that performs parallel sort processing using a plurality of 5-way sorters. delete According to claim 1,
The comparison function is
A homomorphic ciphertext processing method calculated by the operation of the product of an approximate sign function that outputs a preset value according to size comparison and an input value. 5. The method of claim 4,
The approximate sign function is
A homomorphic ciphertext processing method, which is a function obtained by repeating a compound function that makes an output value close to 1 for an input value greater than 0 and an output value close to -1 for an input value less than 0 is repeated a predetermined number of times. 6. The method of claim 5,
The approximate sign function is
A homomorphic ciphertext processing method, which is a function that repeatedly operates two different compound functions three times. According to claim 1,
The 5-way aligner,
When the first isomorphic ciphertext, the second isomorphic ciphertext, and the third isomorphic ciphertext are input, a larger value and a smaller value among the first isomorphic ciphertext and the second isomorphic ciphertext are calculated using the comparison function, and the Inputting the calculated large value and the third isomorphic ciphertext to output a first output value, inputting the calculated small value and the third isomorphic ciphertext to the comparison function to output a third output value, and the first output value to a third isomorphic ciphertext processing method for calculating and outputting a second output value by subtracting the first output value and the third output value from the sum of values for the third homomorphic ciphertext. According to claim 1,
The 5-way aligner,
A homomorphic ciphertext processing method that expands the plaintext space of each of five aligned homomorphic ciphertexts. a memory for storing a plurality of isomorphic cipher texts for approximate messages including errors; and
Including; a processor for aligning the plurality of homomorphic ciphertexts;
The processor is
Sorting the plurality of homomorphic ciphertexts using a 5-way sorter capable of sorting 5 homomorphic ciphertexts in one stage,
The 5-way aligner,
An arithmetic unit that performs sorting using a comparison function that selectively outputs the larger or smaller value among two input values. 10. The method of claim 9,
The processor is
A computing device that performs parallel sorting processing using a plurality of 5-way sorters. delete 10. The method of claim 9,
The comparison function is
An arithmetic device calculated by calculating the product of an approximate sign function that outputs a preset value according to size comparison and an input value. 13. The method of claim 12,
The approximate sign function is
An arithmetic device which is a function obtained by repeatedly calculating a composition function such that an output value approaches 1 for an input value greater than 0 and an output value approaches -1 for an input value less than 0. 14. The method of claim 13,
The approximate sign function is
An arithmetic unit that is a function that repeats each of two different composition functions three times. 10. The method of claim 9,
The 5-way aligner,
When the first isomorphic ciphertext, the second isomorphic ciphertext, and the third isomorphic ciphertext are input, a larger value and a smaller value among the first isomorphic ciphertext and the second isomorphic ciphertext are calculated using the comparison function, and the Inputting the calculated large value and the third isomorphic ciphertext to output a first output value, inputting the calculated small value and the third isomorphic ciphertext to the comparison function to output a third output value, and the first output value to a arithmetic device for calculating and outputting a second output value by subtracting the first output value and the third output value from the sum of the to third homomorphic ciphertexts. The method of claim 9,
The 5-way aligner,
An arithmetic unit that expands the plaintext space of each of five aligned homomorphic ciphertexts. A computer-readable recording medium comprising a program for executing a method for processing homomorphic cipher text,
The processing method of the homomorphic cipher text,
receiving an alignment command for a plurality of homomorphic ciphertexts; and
Including; aligning the plurality of homomorphic ciphertexts using a 5-way sorter capable of sorting five homomorphic ciphertexts in one stage;
The 5-way aligner,
A computer-readable recording medium for performing sorting by using a comparison function that selectively outputs a larger value or a smaller value among two input values.

Images