KR20240047280A - Homomorphic encryption opeation apparatus and method - Google Patents

Abstract

A homomorphic cryptographic operation device and method are disclosed. In a homomorphic encryption operation device, the homomorphic encryption operation device according to one embodiment includes a public key for performing a blind rotation operation and an operand ciphertext of the blind rotation operation ( a receiver that receives an operand ciphertext), and a modified vector is generated by performing preprocessing on vector components of the operand ciphertext based on the degree of the polynomial of the output ciphertext of the blind rotation operation and the modulus of the operand ciphertext, and and a processor that generates a homomorphic cryptographic operation result by performing a blind rotation operation based on the public key and the modified vector.

Description

Homomorphic encryption operation device and method {HOMOMORPHIC ENCRYPTION OPEATION APPARATUS AND METHOD}

The embodiments below relate to a homomorphic cryptographic operation device and method.

Homomorphic encryption is a promising encryption method that allows arbitrary operations between encrypted data. Using homomorphic encryption, not only can arbitrary operations be performed in an encrypted state without decrypting the encrypted data, but it is also safe because it is resistant to quantum algorithms because it is lattice-based.

Blind rotation operation technology is used in homomorphic encryption to perform arbitrary function operations on ciphertext messages, and provides high accuracy for the operation results, but has the disadvantage that the size of the public key is very large.

Although various blind rotation calculation technologies exist, blind rotation calculation still requires a lot of memory, and there is a problem that the amount of calculation increases significantly when the size of the public key required for homomorphic encryption calculation is reduced.

Therefore, there is a need for technology to reduce the size of the public key and reduce the amount of computation of homomorphic encryption operations.

In a homomorphic encryption operation device, the homomorphic encryption operation device according to one embodiment includes a public key for performing a blind rotation operation and an operand ciphertext of the blind rotation operation ( a receiver that receives an operand ciphertext), and a modified vector is generated by performing preprocessing on vector components of the operand ciphertext based on the degree of the polynomial of the output ciphertext of the blind rotation operation and the modulus of the operand ciphertext, and and a processor that generates a homomorphic cryptographic operation result by performing a blind rotation operation based on the public key and the modified vector.

The public key may include a blind rotation key, an automorphism key, and a key switching key.

The public key may be generated based on the modified vector and secret key.

The processor may compare the modulus and the degree of the output ciphertext and generate the modified vector based on the comparison result.

The processor may generate a first set based on some of the vector components of the operand ciphertext, and generate the modified vector based on a second set that is prime to the first set.

If the generator of the vector component of the operand ciphertext is unique, the processor may determine a loop index based on the generator and perform the blind rotation operation based on the loop index.

The processor may perform a first blind operation based on the first set of operand ciphertexts and perform a second blind operation based on the second set of operand ciphertexts.

The processor may perform the blind rotation operation by performing an increment operation, an automorphism operation, and a key switching operation based on the modified vector.

The processor may obtain an odd number and an even number of vector components of the operand ciphertext, and add 1 to the vector component of the operand ciphertext based on a comparison result of the odd number and the even number. there is.

When the vector component of the operand ciphertext is an even number, the processor determines the vector component of the private key of the public key, the negative sum of the vector component of the secret key, and the vector component of the secret key. The blind rotation operation may be performed based on a blind rotation key based on the sum of vector components.

In a homomorphic encryption operation method, the homomorphic encryption operation method according to one embodiment includes a public key for performing a blind rotation operation and an operand ciphertext of the blind rotation operation ( receiving an operand ciphertext) and generating a modified vector by performing preprocessing on vector components of the operand ciphertext based on the degree of a polynomial of the output ciphertext of the blind rotation operation and the modulus of the operand ciphertext; , It may include generating a homomorphic encryption operation result by performing a blind rotation operation on the modified vector based on the public key.

The public key may include a blind rotation key, an automorphism key, and a key switching key.

The public key may be generated based on the modified vector and secret key.

Generating the modified vector may include comparing the modulus and the degree of the output ciphertext, and generating the modified vector based on the comparison result.

Generating the modified vector includes generating a first set based on some of the vector components of the operand ciphertext, and generating the modified vector based on a second set that is prime to the first set. May include steps.

The step of generating the homomorphic encryption operation result includes, when the generator of the vector component of the operand ciphertext is unique, determining a loop index based on the generator, and performing the blind rotation operation based on the loop index. It may include steps to perform.

Generating the homomorphic encryption operation result includes performing a first blind operation based on the first set of operand ciphertexts, and performing a second blind operation based on the second set of operand ciphertexts. May include steps.

The step of generating the homomorphic encryption operation result includes performing the blind rotation operation by performing an increment operation, an automorphism operation, and a key switching operation based on the modified vector. It may include steps.

The step of generating the homomorphic encryption operation result includes obtaining an odd number and an even number of vector components of the operand ciphertext, and generating the operand ciphertext based on a comparison result of the odd number and the even number. It may include adding 1 to the vector components.

The step of generating the homomorphic encryption operation result includes, when the vector component of the operand ciphertext is an even number, the vector component of the private key of the public key, the negative sum of the vector components of the secret key, and the secret It may include performing the blind rotation operation based on a blind rotation key based on the sum of consecutive vector components among the vector components of the key.

Figure 1 shows a schematic block diagram of a homomorphic encryption operation device according to an embodiment.
FIG. 2 shows an example of implementation of the homomorphic cryptographic operation device shown in FIG. 1.
3 to 6 show examples of homomorphic encryption operation operations of the homomorphic encryption operation device shown in FIG. 1.
FIG. 7 shows an example of a key generation operation of the homomorphic encryption operation device shown in FIG. 1.
FIG. 8 shows a flowchart of the operation of the homomorphic encryption operation device shown in FIG. 1.

Hereinafter, embodiments will be described in detail with reference to the attached drawings. However, various changes can be made to the embodiments, so the scope of the patent application is not limited or limited by these embodiments. It should be understood that all changes, equivalents, or substitutes for the embodiments are included in the scope of rights.

The terms used in the examples are for descriptive purposes only and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by a person of ordinary skill in the technical field to which the embodiments belong. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and unless explicitly defined in the present application, should not be interpreted in an ideal or excessively formal sense. No.

In addition, when describing with reference to the accompanying drawings, identical components will be assigned the same reference numerals regardless of the reference numerals, and overlapping descriptions thereof will be omitted. In describing the embodiments, if it is determined that detailed descriptions of related known technologies may unnecessarily obscure the gist of the embodiments, the detailed descriptions are omitted.

Additionally, in describing the components of the embodiment, terms such as first, second, A, B, (a), and (b) may be used. These terms are only used to distinguish the component from other components, and the nature, sequence, or order of the component is not limited by the term. When a component is described as being "connected," "coupled," or "connected" to another component, that component may be directly connected or connected to that other component, but there is no need for another component between each component. It should be understood that may be “connected,” “combined,” or “connected.”

Components included in one embodiment and components including common functions will be described using the same names in other embodiments. Unless stated to the contrary, the description given in one embodiment may be applied to other embodiments, and detailed description will be omitted to the extent of overlap.

Figure 1 shows a schematic block diagram of a homomorphic encryption operation device according to an embodiment.

Referring to FIG. 1, the homomorphic encryption operation device 10 can perform encryption and decryption using homomorphic encryption. The homomorphic encryption operation device 10 can perform a blind rotation operation for homomorphic encryption operation.

The homomorphic encryption operation device 10 can generate an operation result by performing a homomorphic encryption operation. The homomorphic cryptographic operation device 10 may generate a ciphertext (eg, operand ciphertext) for performing a blind rotation operation. The homomorphic cryptography operation device 10 can generate a secret key and a public key. The public key may include a key switching key, a blind rotation key, and/or an automorphism key.

The homomorphic encryption operation device 10 may perform a blind rotation operation using the generated encryption key, ciphertext, and/or blind rotation key.

Homomorphic encryption may refer to an encryption method configured to perform various operations while encrypting data. In homomorphic encryption, the result of an operation using ciphertexts becomes a new ciphertext, and the plaintext obtained by decrypting the ciphertext may be the same as the result of the operation of the original data before encryption.

Hereinafter, encrypted data or ciphertext may be referred to as ciphertext. Cyphertext can take the form of a polynomial or a vector containing polynomials.

The homomorphic encryption operation device 10 can perform a homomorphic encryption operation based on the RLWE (Ring Learning With Error) problem that supports ciphertext operation by encrypting plaintext consisting of binary numbers. The homomorphic encryption operation device 10 can perform a homomorphic encryption operation based on the RLWE problem that supports ciphertext operation by encrypting plaintext consisting of integers. The homomorphic encryption operation device 10 can perform an approximate homomorphic encryption operation based on the RLWE problem that supports ciphertext operation by encrypting plaintext consisting of real numbers and/or complex numbers.

The homomorphic encryption operation device 10 can derive the same result as the result of calculating data in a plaintext state by decrypting the result of calculation in an encrypted state using homomorphic encryption.

The homomorphic encryption operation device 10 can perform operations on ciphertext, blind rotation operations (e.g., lookup table (LUT) operations) and key generation. Homomorphic encryption operation device (10) can perform operations on non-polynomial functions using a blind rotation method in homomorphic encryption.

The homomorphic encryption operation device 10 can perform an encryption process to encrypt input data in Privacy Preserving Machine Learning (PPML) and application services. The homomorphic encryption operation device 10 can be used in the encryption process of encrypting input values in information protection machine learning and application services.

The homomorphic encryption operation device 10 can increase cryptographic safety in homomorphic encryption and application services utilizing homomorphic encryption by eliminating space constraints for storing the secret key and adjusting the size of the vector constituting the secret key. .

The homomorphic cryptography operation device 10 can adjust the storage space for storing keys (e.g., secret keys, key switching keys, homomorphic mapping keys, or blind rotation keys) used by servers and clients and the amount of computation of homomorphic cryptography operations. .

The homomorphic encryption operation device 10 can be implemented in the form of a chip and mounted on a hardware accelerator that utilizes homomorphic encryption. The homomorphic cryptographic processing device 10 can be implemented in the form of a chip or software to reduce memory usage of various computing devices. The homomorphic encryption calculation device 10 can reduce the overall calculation amount of the server by reducing the calculation amount of the homomorphic encryption operation.

The homomorphic cryptographic operation device 10 can provide high cryptographic stability by adjusting the size of the secret key vector. The homomorphic encryption operation device 10 can perform encryption on input data of the homomorphic encryption operation.

The homomorphic cryptographic computing device 10 may be implemented within a personal computer (PC), a data server, or a portable device.

Portable devices include laptop computers, mobile phones, smart phones, tablet PCs, mobile internet devices (MIDs), personal digital assistants (PDAs), and enterprise digital assistants (EDAs). , digital still camera, digital video camera, portable multimedia player (PMP), personal navigation device or portable navigation device (PND), handheld game console, e-book ( It can be implemented as an e-book) or a smart device. A smart device may be implemented as a smart watch, smart band, or smart ring.

The homomorphic cryptography operation device 10 includes a receiver 100 and a processor 200. The homomorphic encryption operation device 10 may further include a memory 300.

Receiver 100 may include a receiving interface. The receiver 100 may receive data for performing a homomorphic encryption operation from an external source or the memory 300. The data may be either operand data (e.g., operand ciphertext) or a key (e.g., secret key, key switching key, automorphism key, and/or blind rotation key) to perform a homomorphic cryptographic operation. ) may include.

The blind rotation key can be generated based on RGSW (Ring Gentry, Sahai, Waters) or RLWE (Ring Learning With Error)' ciphertext. The key switching key may be generated based on the RLWE' ciphertext. The operand ciphertext can be generated based on LWE (Learning With Error) ciphertext.

The receiver 100 may receive a public key for performing a blind rotation operation and an operand ciphertext of the blind rotation operation. Public keys may include blind rotation keys, automorphic mapping keys, and key switching keys. The receiver 100 may output the received public key and operand ciphertext to the processor 200.

The processor 200 may process data stored in the memory 300. The processor 200 may execute computer-readable code (eg, software) stored in the memory 300 and instructions triggered by the processor 200 .

The “processor 200” may be a data processing device implemented in hardware that has a circuit with a physical structure for executing desired operations. For example, the intended operations may include code or instructions included in the program.

For example, data processing devices implemented in hardware include microprocessors, central processing units, processor cores, multi-core processors, and multiprocessors. , ASIC (Application-Specific Integrated Circuit), and FPGA (Field Programmable Gate Array).

The processor 200 may generate a modified vector by performing preprocessing on the vector components of the operand ciphertext based on the degree of the polynomial of the output ciphertext of the blind rotation operation and the modulus of the operand ciphertext.

The processor 200 may compare the modulus of the operand ciphertext and the degree of the output ciphertext. The processor 200 may generate a modified vector based on the comparison result.

The processor 200 may generate the first set based on some of the vector components of the operand ciphertext. Processor 200 may generate a modified vector based on the first set and the second set that are mutually prime.

The processor 200 may generate a homomorphic encryption operation result by performing a blind rotation operation based on the public key and the modified vector. The public key can be generated based on the modified vector and secret key.

If the generator of the vector component of the operand ciphertext is unique, the processor 200 may determine the loop index based on the generator. The processor 200 may perform a blind rotation operation based on the loop index.

The processor 200 may perform a first blind operation based on the first set of operand ciphertexts. The processor 200 may perform a second blind operation based on the second set of operand ciphertexts.

The processor 200 may perform a blind rotation operation by performing an increment operation, an automorphism operation, and a key switching operation based on the modified vector.

The processor 200 may obtain an odd number and an even number of vector components of the operand ciphertext. The processor 200 may add 1 to the vector component of the ciphertext based on the comparison result of the odd number and the even number.

If the vector component of the operand ciphertext is an even number, the processor 200 determines the vector component of the secret key of the public key, the negative sum of the vector component of the secret key, and the vector components of the secret key. A blind rotation operation can be performed based on the sum-based blind rotation key.

The memory 300 may store instructions (or programs) executable by the processor 200. For example, the instructions may include instructions for executing the operation of the processor 200 and/or the operation of each component of the processor 200.

The memory 300 may be implemented as a volatile memory device or a non-volatile memory device.

Volatile memory devices may be implemented as dynamic random access memory (DRAM), static random access memory (SRAM), thyristor RAM (T-RAM), zero capacitor RAM (Z-RAM), or twin transistor RAM (TTRAM).

Non-volatile memory devices include EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, MRAM (Magnetic RAM), Spin-Transfer Torque (STT)-MRAM (MRAM), and Conductive Bridging RAM (CBRAM). , FeRAM (Ferroelectric RAM), PRAM (Phase change RAM), Resistive RAM (RRAM), Nanotube RRAM (Nanotube RRAM), Polymer RAM (PoRAM), Nano Floating Gate Memory (NFGM), holographic memory, molecular electronic memory device, or insulator resistance change memory.

FIG. 2 shows an example of the operation of the homomorphic encryption operation device shown in FIG. 1.

Referring to FIG. 2, the ciphertext used by a processor (e.g., processor 200 of FIG. 1) for homomorphic encryption operation can be defined as follows.

In LWE ciphertext, the ciphertext of message (or plaintext) m is It can be expressed as: The ciphertext is It can be decrypted as follows. is the secret key This may mean encryption of message m using .

In RLWE ciphertext, the ciphertext of message m is It can be expressed as: The ciphertext is It can be decrypted as follows. may mean encryption of message m using secret key z .

The RLWE ciphertext of message m using secret key z can be defined as Equation 1.

here, refers to a polynomial on modulus Q, and e may refer to an error polynomial with a small coefficient. When each encryption is performed, and e may be randomly generated.

The RLWE' ciphertext of message m for secret key s can be defined as Equation 2.

here, is a vector defined in advance to decompose a random integer. about form of or about It can be set in the form of .

secret key The RGSW ciphertext of message m for can be defined as two RLWE' ciphertexts as shown in Equation 3.

Homomorphic cryptographic operations performed by the processor 200 can be defined as follows.

In the self-homomorphic mapping operation of RLWE ciphertext, the self-homomorphic mapping of a polynomial ring is an element of the polynomial ring about Outputs , and the spaces of the domain and conjugate may be the same. In the RLWE ciphertext, the processor 200 inputs the input through a homomorphic mapping operation. about can be output.

The processor 200 may obtain the ciphertext corresponding to the new secret key z ₂ from the ciphertext corresponding to the secret key z ₁ through a key switching operation. Processor 200 inputs ciphertext About public key key switching key A new ciphertext with z ₂ as the secret key using can be obtained.

The processor 200 may perform a blind rotation operation. The processor 200 performs an arbitrary function using a blind rotation key. and ciphertext By performing a blind rotation operation on can be output.

The generator of odd numbers on integers can be defined as follows. A ring of integers modulo q. is an integer from 0 to q-1, and addition and multiplication can be defined.

There is an inverse for multiplication and may mean a subset of an integer ring with modulo q. Is It may refer to a set for which a multiplicative inverse exists among subsets of . If can be expressed as a power of gi, then _gi are It can be referred to as the constructor of .

Processor 200 generally considers the case where q is a power of 2, in which case: can have as elements all odd sets of q or less that are prime to 2. When q is a power of 2, all odd numbers can be expressed as powers of 5 and -1. For example, odd numbers are It can be expressed as thus, It can be expressed as

A disjoint family of sets can refer to two sets that have no common elements. Any vector whose modulus is a power of 2 For each vector component go and If divided into and can be a set of each other.

The processor 200 uses the LWE ciphertext as the operand ciphertext. from By calculating using the blind rotation key, You can perform a blind rotation operation that calculates the operation result of the message to which function f is applied. The processor 200 can reduce the size of the public key and the amount of calculation required in the blind rotation calculation process.

The processor 200 determines that for all odd t, the key switching key does not have ak _t , and ak _g and Blind rotation operations can be performed using only ak _-g .

The processor 200 creates the LWE ciphertext by performing a preprocessing process. The vector component of , the required blind rotation key and key switching key can be generated by comparing the modulus q and 2N based on the degree of the RLWE ciphertext.

In the process of performing a blind rotation operation, the processor 200 The modified vector based on a comparison of the vector components of and the modulus q, which is the range of the vector components of the LWE ciphertext, and 2N, which is twice the degree of the generated RLWE ciphertext. can be created.

The processor 200 determines the components of the modified vector. Based on the properties of , the RLWE ciphertext can be updated by performing self-homomorphic mapping operations, increment operations, and key switching key operations.

The processor 200 processes the modified vector generated in the preprocessing process. If additional operations are required depending on the value of , the RLWE ciphertext can be updated by performing an increment operation.

The processor 200 produces a result of the homomorphic encryption operation. can be output.

The processor 200 may include an operator 250. The key generator 210 and operator 250 may be implemented in different devices. For example, key generator 210 may be implemented on a client and operator 250 may be implemented on a server.

Hereinafter, the processor 200 will be described based on the case where it includes only the operator 250. However, depending on the embodiment, the processor 200 may include the key generator 210.

Key generator 210 may generate a secret key (211). Key generator 210 may generate a public key based on the private key (213). The public key may include a key switching key or a blind rotation key. Key generator 210 may generate secret keys for LWE ciphertext and RLWE ciphertext. The key generator 210 may generate LWE ciphertext based on the generated secret key.

The key generator 210 may output the generated public key to the receiver 230 or the calculator 250. The key generator 210 can transmit the generated public key wirelessly or wired.

The receiver 230 may operate in the same manner as the receiver 100 of FIG. 1 . The receiver 230 may receive the operand ciphertext (e.g., LWE ciphertext) and output it to the operator 250.

The operator 250 may generate a modified vector by performing preprocessing on the operand ciphertext. The operator 200 is an LWE ciphertext A blind rotation operation can be performed by receiving. The operator 200 calculates the result of the message for function f. It can be calculated using .

The operator 250 may generate a modified vector by performing preprocessing based on the LWE ciphertext (251). The operator 250 may output the modified vector to the key generator 210.

Key generator 210 generates LWE ciphertext Vector components of Each vector component of , modulus q and 2N based on the degree of the RLWE ciphertext can be compared and analyzed.

The key generator 210 is a comparative analysis result. The generator for generating can be checked, and as a result of the check, the necessary blind rotation key and key switching key can be generated and transmitted to the operator 250.

The operator 250 may repeatedly perform a blind rotation operation based on the public key received from the key generator 210 (253). The operator 250 may perform an increment operation, an automorphic mapping operation, and a key switching operation.

Operator 250 is a modified vector ingredients of can be divided into a first set and a second set that are prime to each other. The first set is , and the second set is It can be. The calculator 250 is Perform a blind rotation operation on the vector components within, Perform a blind rotation operation on the vector components corresponding to , and then, A blind rotation operation can be performed on the vector component corresponding to . The order of operations may change depending on the embodiment. The process of blind rotation calculation will be described in detail with reference to FIGS. 3 to 6.

The operator 250 is a vector and modified vector A final increment operation can be performed on the part caused by the difference (255). The operator 250 produces the RLWE ciphertext as the final calculation result. can be output.

FIG. 3 shows an example of a homomorphic encryption operation of the homomorphic encryption operation device shown in FIG. 1.

Referring to FIG. 3, the example of FIG. 3 may exemplarily illustrate a blind rotation operation process when all vector components of a given LWE ciphertext are odd numbers.

A key generator (e.g., key generator 210 in Figure 2) generates the input LWE ciphertext. It can be created with The key generator 210 generates a blind rotation key, which is an RGSW ciphertext corresponding to each secret key. can be created. Key generator 210 may generate automorphic mapping keys ak _g and ak _-g corresponding to g and -g. Key generator 210 is cast You can create a key switching key to change to . The key generator 210 may output the generated LWE ciphertext, blind rotation key, homomorphic mapping key, and key switching key to an operator (eg, operator 250 in FIG. 2).

The calculator 250 can set an initial value (311). The operator 250 can set an initial value in the form of a ring element.

The operator 250 is a component of the modified vector. cast and It can be divided into The calculator 250 is To perform a blind rotation operation on the vector components within can be set (313).

The calculator 250 is A loop of blind rotation operation can be performed for i that satisfies (315). The operator 250 may perform an increment operation on RGSW (317). The operator 250 may perform a homomorphic mapping operation on g and a key switching operation to restore the secret key to the original secret key (319).

The operator 250 calculates all values except j=0 through operations 321 and 323. It can be confirmed that operations 313 to 319 have been performed.

The calculator 250 is A loop of blind rotation operation can be performed for i that satisfies (325). The calculator 250 is An increment operation can be performed on the vector components of (327). The operator 250 may perform a homomorphic mapping operation for -g and a key switching operation to restore the secret key to its original state (329).

The calculator 250 is can be set (331). The calculator 250 is A loop of blind rotation operation can be performed for i that satisfies (333). The calculator 250 is An increment operation can be performed on the vector components (335). The operator 250 may perform a homomorphic mapping operation for -g and a key switching operation to restore the secret key to its original state (337).

The operator 250 calculates all values except j'=0 through operations 339 and 341. It can be confirmed that operations 313 to 319 have been performed. The operator 250 may perform an increment operation through operations 343 and 345 and output the RLWE ciphertext as a blind rotation operation result.

Using the example of FIG. 3, if the vector component of the LWE ciphertext is an odd number regardless of the size of the vector component, the homomorphic encryption operation device (e.g., the homomorphic encryption operation device 10 of FIG. 1) performs self-homomorphism during blind rotation operation. Homomorphic encryption operations can be performed by minimizing the number of self-homomorphic mapping keys and key switching keys that require mapping.

FIG. 4 shows another example of the homomorphic encryption operation of the homomorphic encryption operation device shown in FIG. 1.

Referring to Figure 4, LWE ciphertext It can represent the blind rotation calculation process when contains an even number of vector components.

A key generator (e.g., key generator 210 in Figure 2) generates the input LWE ciphertext. It can be created with The key generator 210 generates a blind rotation key, which is an RGSW ciphertext corresponding to each secret key. can be created. The key generator 210 generates an RGSW ciphertext corresponding to the negative sum of the vector components of the secret key. can be created with a blind rotation key.

Key generator 210 may generate automorphic mapping keys ak _g and ak _-g corresponding to g and -g. Key generator 210 is cast You can create a key switching key to change to . The key generator 210 may output the generated LWE ciphertext, blind rotation key, homomorphic mapping key, and key switching key to an operator (eg, operator 250 in FIG. 2).

The calculator 250 can set an initial value (411). The calculator 250 can set an initial value in the form of a ring component. The operator 250 can obtain and compare the number of odd numbers and the number of even numbers among the vector components of the operand ciphertext (413).

If the number of even numbers is greater, the operator 250 An increment operation can be performed using (415). The operator 250 is an LWE ciphertext cast It can be changed to (417).

If the number of odd numbers is greater, the operator 250 can maintain the LWE ciphertext in its existing form (419). The operator 250 can set i=0 (421). Starting from i=0, the operator 250 can check whether the vector component for i satisfying i<n is an even number (423).

If the vector component is an even number, the operator 250 A modified vector can be generated based on (425). If the vector component is odd, the operator 250 A modified vector can be generated based on (427). The operator 250 may increase i (429). The operator 250 may determine i<n (431). The operator 250 uses processes 423 to 431 to generate a modified vector in which all vector components are odd. can be created.

Operator 250 is a modified vector and secret key A blind rotation operation can be performed based on (433). The process of performing the blind rotation operation may be the same as in FIG. 3.

The operator 250 may additionally perform an increment operation of the RGSW ciphertext using processes 435 to 443 when the vector component of the LWE operation is an even number. The calculator 250 is It is possible to determine whether is an even number (435). If it is an even number, the operator 250 The increment operation can be performed (439). The operator 250 may increase i (441). The operator 250 may determine i<n (443). If is an odd number, the calculator 250 can perform operation 443.

The operator 250 may output RLWE ciphertext as the final calculation result.

Using the example of FIG. 4, when the vector component of the LWE ciphertext includes an even number, the operator 250 can efficiently use the storage space of the memory by adding only one blind rotation operation key. The operator 250 performs an increment operation using the RGSW ciphertext up to By generating only one time, the trade-off relationship between memory and computation can be adjusted.

FIG. 5 shows another example of the homomorphic encryption operation of the homomorphic encryption operation device shown in FIG. 1.

Referring to FIG. 5, the example of FIG. 5 may exemplarily illustrate a blind rotation calculation process when the vector components of the LWE ciphertext include even components.

A key generator (e.g., key generator 210 in Figure 2) generates the input LWE ciphertext. It can be created with The key generator 210 generates a blind rotation key, which is an RGSW ciphertext corresponding to each secret key. can be created. The key generator 210 generates an RGSW ciphertext corresponding to the negative sum of the vector components of the secret key. can be created with a blind rotation key. The key generator 210 is an RGSW ciphertext based on the sum of consecutive vector components. can be created with a blind rotation key.

Key generator 210 may generate automorphic mapping keys ak _g and ak _-g corresponding to g and -g. Key generator 210 is cast You can create a key switching key to change to . The key generator 210 may output the generated LWE ciphertext, blind rotation key, homomorphic mapping key, and key switching key to an operator (eg, operator 250 in FIG. 2).

The operator 250 can set an initial value (511). The calculator 250 can set an initial value in the form of a ring component. The operator 250 may determine whether the first component of the vector component of the LWE ciphertext is an even number (513).

If the first component is an even number, the operator 250 An increment operation can be performed using (515). The operator 250 is an LWE ciphertext cast It can be changed to (517). If the first component is odd, the operator 250 can maintain the LWE ciphertext in its existing form (519).

The operator 250 may perform operations 521 to 531 to change the vector component of the LWE ciphertext into a value capable of performing a self-homomorphic mapping operation. The operator 250 may start calculation from i=0 (521).

Operator 250 is a vector component It is possible to determine whether this is an odd number (523). If it is an odd number, the operator 250 combines the secret key vector and the modified vector. and It can be set as follows (525).

If the number is even, the operator 250 combines the secret key vector and the modified vector. and It can be set as follows (527).

The operator 250 may increase i (529). The operator 250 may determine i<n-1 (531). If the condition of 531 is not satisfied, the operator 250 calculates the modified vector and new secret key vector You can perform blind rotation calculation using . The blind rotation operation can be performed in the same way as described in FIG. 3.

The operator 250 may output RLWE ciphertext as the final calculation result.

Using the example of FIG. 5, when the vector component of the LWE ciphertext includes an even number, the operator 250 may additionally perform an increment operation using the RGSW ciphertext only once, depending on whether the first vector component is an odd number. You can. Accordingly, the calculator 250 can efficiently perform homomorphic encryption calculations by reducing the amount of calculation. At this time, since N+1 additional blind rotation keys are generated, a trade-off may occur between memory and calculation amount.

FIG. 6 shows another example of the homomorphic encryption operation of the homomorphic encryption operation device shown in FIG. 1.

Referring to FIG. 6, the example in FIG. 6 is when a blind rotation operation is performed, If or the constructor that generates the vector components of the LWE ciphertext is The unique case can be expressed as In this case, all vector components may have a remainder of 1 when divided by 4, It has the form of and may not have the form of a negative number.

A key generator (e.g., key generator 210 in Figure 2) generates the input LWE ciphertext. It can be created with The key generator 210 generates a blind rotation key, which is an RGSW ciphertext corresponding to each secret key. can be created. create ak _g' , cast You can create a key switching key to change to . The key generator 210 may output the generated LWE ciphertext, blind rotation key, homomorphic mapping key, and key switching key to an operator (eg, operator 250 in FIG. 2).

The calculator 250 can set an initial value (611). The calculator 250 can set an initial value in the form of a ring component. The operator 250 operates on each vector component. cast Divide by, j=ord-1 can be set to start a blind rotation operation from the vector components within (613). Ord is It can mean the smallest positive integer that satisfies .

The calculator 250 is A blind rotation operation can be performed on all components within (615). The operator 250 may perform an increment operation on RGSW (617). The calculator 250 is A self-homomorphic mapping operation may be performed on , and a key switching operation may be performed to restore the secret key to the original secret key (619).

The calculator 250 calculates all values except j=0 through processes 621 and 623. It is possible to check whether processes 615 to 619 have been performed.

The calculator 250 operates through process 625. An increment operation can be performed on all vector components of (627). The operator 250 can output the RLWE ciphertext as a blind rotation operation result.

A homomorphic encryption operation device (e.g., the homomorphic encryption operation device 10 in FIG. 1) uses the example of FIG. 6 according to the vector components of the LWE ciphertext or the parameter values of the homomorphic encryption to achieve homomorphism using only one self-homomorphic mapping key. Cryptographic operations can be performed efficiently.

In another embodiment, the operator 250 calculates the vector components of the LWE ciphertext. For some j when divided by and may all be empty sets. In this case, the operator 250 can reduce the number of unnecessary blind rotations by generating and using a plurality of self-homomorphic mapping keys for the generator. For example, the operator 250 can generate ak _g , ??, ak _gb , and ak _-g as automorphic mapping keys. The embodiment of generating a plurality of homomorphic mapping keys can be applied to all of the embodiments of FIGS. 3 to 6.

FIG. 7 shows an example of a key generation operation of the homomorphic encryption operation device shown in FIG. 1.

Referring to Figure 7, the key generator (e.g., key generator 210 of Figure 2) If , or the operand ciphertext (e.g. LWE ciphertext) The constructor that creates the vector components of In the unique case, a generator that generates vector components of the LWE ciphertext to perform the blind rotation operation shown in the example in Figure 6. based on value , ak _g' , cast You can create a key switching key to change to .

Key generator 250 is or the constructor You can determine whether it is unique (711). If the key generator 250 satisfies the condition 711, , ak _g' , cast You can create a key switching key to change to (713). The key generator 250 may transmit the public key generated at 713 to an operator (e.g., the operator 250 of FIG. 2) (725).

If the generator is not unique, the key generator 250 may determine whether an even number exists in the vector components and generate a public key as in the embodiment of FIG. 3. Alternatively, the key generator 250 may determine the importance of memory efficiency and computational efficiency, generate a public key like the embodiment of FIGS. 4 and 5, and transmit it to the calculator 250.

If the condition of 711 is not satisfied, the key generator 250 It is possible to determine whether is an odd number (715). If is an odd number, the key generator 250 , ak _g and ak _-g can be generated (717). The key generator 250 may transmit the public key generated at 717 to the operator 250 (725).

If is an even number, the key generator 250 can select the one with higher importance among memory efficiency and computational efficiency (719). When memory efficiency is of high importance, the key generator 250 uses a blind rotation key and , and the automorphic mapping keys ak _g and ak _-g can be generated (721). The key generator 250 may transmit the public key generated at 721 to the operator 250 (725).

When computational efficiency is of high importance, the key generator 250 generates a blind rotation key. , and , and the automorphic mapping keys ak _g and ak _-g can be generated (723). The key generator 250 may transmit the public key generated at 723 to the operator 250 (725).

FIG. 8 shows a flowchart of the operation of the homomorphic encryption operation device shown in FIG. 1.

Referring to FIG. 8, a receiver (e.g., receiver 100 of FIG. 1) may receive a public key for performing a blind rotation operation and an operand ciphertext of the blind rotation operation. The public key may include a blind rotation key, an automorphic mapping key, and a key switching key (810).

The processor 200 may generate a modified vector by performing preprocessing on the vector components of the operand ciphertext based on the degree of the polynomial of the output ciphertext of the blind rotation operation and the modulus of the operand ciphertext (830).

The processor 200 may compare the modulus of the operand ciphertext and the degree of the output ciphertext. The processor 200 may generate a modified vector based on the comparison result.

The processor 200 may generate the first set based on some of the vector components of the operand ciphertext. Processor 200 may generate a modified vector based on the first set and the second set that are mutually prime.

The processor 200 may generate a homomorphic encryption operation result by performing a blind rotation operation based on the public key and the modified vector (850). The public key can be generated based on the modified vector and secret key.

If the generator of the vector component of the operand ciphertext is unique, the processor 200 may determine the loop index based on the generator. The processor 200 may perform a blind rotation operation based on the loop index.

The processor 200 may perform a first blind operation based on the first set of operand ciphertexts. The processor 200 may perform a second blind operation based on the second set of operand ciphertexts.

The processor 200 may perform a blind rotation operation by performing an increment operation, an automorphism operation, and a key switching operation based on the modified vector.

The processor 200 may obtain an odd number and an even number of vector components of the operand ciphertext. The processor 200 may add 1 to the vector component of the ciphertext based on the comparison result of the odd number and the even number.

If the vector component of the operand ciphertext is an even number, the processor 200 determines the vector component of the secret key of the public key, the negative sum of the vector component of the secret key, and the vector components of the secret key. A blind rotation operation can be performed based on the sum-based blind rotation key.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and configured for the embodiment or may be known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing unit to operate as desired, or may be processed independently or collectively. You can command the device. Software and/or data may be used on any type of machine, component, physical device, virtual equipment, computer storage medium or device to be interpreted by or to provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

Although the embodiments have been described with limited drawings as described above, those skilled in the art can apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order than the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or other components are used. Alternatively, appropriate results may be achieved even if substituted or substituted by an equivalent.

Therefore, other implementations, other embodiments, and equivalents of the claims also fall within the scope of the following claims.

Claims (20)

In a homomorphic encryption operation device,
A receiver that receives a public key for performing a blind rotation operation and an operand ciphertext of the blind rotation operation; and
Generating a modified vector by performing preprocessing on vector components of the operand ciphertext based on the degree of the polynomial of the output ciphertext of the blind rotation operation and the modulus of the operand ciphertext,
A processor that generates a homomorphic cryptographic operation result by performing a blind rotation operation based on the public key and the modified vector.
A homomorphic cryptographic operation device comprising a.
According to paragraph 1,
The public key is,
Includes a blind rotation key, an automorphism key and a key switching key,
Homomorphic cryptographic computing unit.
According to paragraph 1,
The public key is,
Generated based on the modified vector and secret key,
Homomorphic cryptographic computing unit.
According to paragraph 1,
The processor,
Compare the modulus and the degree of the output ciphertext,
generating the modified vector based on the comparison results,
Homomorphic cryptographic computing unit.
According to paragraph 1,
The processor,
Generate a first set based on some of the vector components of the operand ciphertext,
generating the modified vector based on a second set that is prime to the first set,
Homomorphic cryptographic computing unit.
According to paragraph 1,
The processor,
If the generator of the vector component of the operand ciphertext is unique,
Determine a loop index based on the constructor,
Performing the blind rotation operation based on the loop index,
Homomorphic cryptographic computing unit.

According to paragraph 1,
The processor,
perform a first blind operation based on the first set of operand ciphertexts,
performing a second blind operation based on the second set of operand ciphertexts,
Homomorphic cryptographic computing unit.
According to paragraph 1,
The processor,
Performing the blind rotation operation by performing an increment operation, an automorphism operation, and a key switching operation based on the modified vector,
Homomorphic cryptographic computing unit.
According to paragraph 1,
The processor,
Obtaining an odd number and an even number of vector components of the operand ciphertext,
Adding 1 to the vector component of the operand ciphertext based on a comparison result of the odd number and the even number,
Homomorphic cryptographic computing unit.
According to paragraph 1,
The processor,
If the vector component of the operand ciphertext is an even number,
The blind rotation operation based on a vector component of the private key of the public key, a negative sum of the vector components of the private key, and a blind rotation key based on the sum of successive vector components among the vector components of the private key. To perform,
Homomorphic cryptographic computing unit.
In the homomorphic encryption operation method,
Receiving a public key for performing a blind rotation operation and an operand ciphertext of the blind rotation operation;
generating a modified vector by performing preprocessing on vector components of the operand ciphertext based on the degree of a polynomial of the output ciphertext of the blind rotation operation and the modulus of the operand ciphertext; and
Generating a homomorphic encryption operation result by performing a blind rotation operation on the modified vector based on the public key.
A homomorphic cryptographic operation method including.
According to clause 11,
The public key is,
Includes a blind rotation key, an automorphism key and a key switching key,
Homomorphic encryption operation method.
According to clause 11,
The public key is,
Generated based on the modified vector and secret key,
Homomorphic encryption operation method.
According to clause 11,
The step of generating the modified vector is,
Comparing the modulus and the degree of the output ciphertext; and
generating the modified vector based on the comparison result
A homomorphic cryptographic operation method including.
According to clause 11,
The step of generating the modified vector is,
generating a first set based on some of the vector components of the operand ciphertext; and
generating the modified vector based on a second set that is mutually prime with the first set.
A homomorphic cryptographic operation method including.
According to clause 11,
The step of generating the homomorphic encryption operation result is,
If the generator of the vector component of the operand ciphertext is unique, determining a loop index based on the generator; and
Performing the blind rotation operation based on the loop index
A homomorphic cryptographic operation method including.
According to clause 11,
The step of generating the homomorphic encryption operation result is,
performing a first blind operation based on the first set of operand ciphertexts; and
performing a second blind operation based on the second set of operand ciphertexts.
A homomorphic cryptographic operation method including.
According to clause 11,
The step of generating the homomorphic encryption operation result is,
Performing the blind rotation operation by performing an increment operation, an automorphism operation, and a key switching operation based on the modified vector.
A homomorphic cryptographic operation method including.
According to clause 11,
The step of generating the homomorphic encryption operation result is,
Obtaining an odd number and an even number of vector components of the operand ciphertext,
Adding 1 to the vector component of the operand ciphertext based on a comparison result of the odd number and the even number.
A homomorphic cryptographic operation method including.
According to paragraph 1,
The step of generating the homomorphic encryption operation result is,
When the vector component of the operand ciphertext is an even number, the vector component of the private key of the public key, the negative sum of the vector components of the private key, and the sum of consecutive vector components among the vector components of the private key performing the blind rotation operation based on a blind rotation key based on
A homomorphic cryptographic operation method including.

Images