Patent Application
20240214178
The present invention relates to a homomorphic cyclic operation system, homomorphic cyclic operation apparatus, homomorphic cyclic operation method, and homomorphic cyclic operation program.
Homomorphic encryption is a cryptographic technique. When ciphertexts Enc(m1), Enc(m2) of plaintexts m1, m2 are given, homomorphic encryption allows a ciphertext Enc(m1 ◯m2) of a binary operation m1◯m2 of the plaintexts m1, m2 to be computed without the ciphertext Enc(m1 ◯m2) being decrypted back into the plaintexts m1, m2. Here, “◯” is a binary operation such as addition “+” or multiplication “x.” Homomorphic encryption related to addition “+” is called additive homomorphic encryption. Further, homomorphic encryption that is also homomorphic with respect to multiplication “x” is called fully homomorphic encryption.
Fully homomorphic encryption has the best properties because it is homomorphic with respect to both addition and multiplication. However, fully homomorphic encryption presents difficulties in practical use as it requires a large amount of computation. Therefore, homomorphic encryptions with intermediate properties between additive and fully homomorphic encryptions have also been developed. For instance, a cryptosystem called somewhat homomorphic encryption is an encryption scheme homomorphic with respect to a finite number of additions and multiplications (for instance, refer to Non-Patent Literature 1).
The disclosure of the literature in Citation List above is incorporated herein in its entirety by reference thereto. The following analysis is given by the present inventors.
In a real computer system, it is common to provide not only addition and multiplication but also other frequently used operations. This is because it is more convenient to provide a user with a predetermined operation as a protocol than to provide an operation that can theoretically be achieved by a combination of addition and multiplication. An example of such an operation is a cyclic operation. The cyclic operation moves storage locations of a periodic array of data while maintaining the order of the data array. The operation that moves storage locations while maintaining the order of data is generally referred to as a shift, and the cyclic operation shifts a periodic array.
It goes without saying that, performing a cyclic operation in a homomorphic encryption system requires not only simply implementing the cyclic operation but also shifting the storage locations of data without decrypting a periodic array of the encrypted data. Moreover, to implement a cyclic operation in homomorphic encryption, it is also necessary to address the computational cost, which is a problem unique to homomorphic encryption.
In view of the problem above, it is an object of the present invention to provide a homomorphic cyclic operation system, homomorphic cyclic operation apparatus, homomorphic cyclic operation method, and homomorphic cyclic operation program that shift data storage locations without decrypting a periodic array of encrypted data.
According to a first aspect of the present invention, there is provided a homomorphic cyclic operation system performing a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, the homomorphic cyclic operation system comprising: an encryption apparatus that encrypts the periodic array of data by storing it in the coefficients of an indeterminate polynomial to generate a ciphertext of periodic data; and a homomorphic cyclic operation apparatus that shifts the periodic array of data in the ciphertext of the periodic data by applying the indeterminate raised to the power of a shift amount to the ciphertext of the periodic data.
According to a second aspect of the present invention, there is provided a homomorphic cyclic operation apparatus performing a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, wherein the homomorphic cyclic operation apparatus shifts the periodic array of data in a ciphertext of the periodic data by encrypting the periodic array of data by storing it in the coefficients of an indeterminate polynomial to generate the ciphertext and applying the indeterminate raised to the power of a shift amount to the ciphertext.
According to a third aspect of the present invention, there is provided a homomorphic cyclic operation method performing a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, the homomorphic cyclic operation method comprising: a step of encrypting the periodic array of data by storing it in the coefficients of an indeterminate polynomial to generate a ciphertext of periodic data; and a step of shifting the periodic array of data in the ciphertext of the periodic data by applying the indeterminate raised to the power of a shift amount to the ciphertext of the periodic data.
According to a fourth aspect of the present invention, there is provided a program causing a computer to perform a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, wherein the program shifts the periodic array of data in a ciphertext of the periodic data by applying the indeterminate raised to the power of a shift amount to the ciphertext, wherein the ciphertext of the periodic data is encrypted by storing it in the coefficients of an indeterminate polynomial. Further, this program can be stored in a computer-readable storage medium. The storage medium may be a non-transitory one such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, and the like. The present invention can also be realized as a computer program product.
According to each aspect of the present invention, it becomes possible to provide a homomorphic cyclic operation system, homomorphic cyclic operation apparatus, homomorphic cyclic operation method, and homomorphic cyclic operation program that shift data storage locations without decrypting a periodic array of encrypted data.
Example embodiments of the present invention will be described with reference to the drawings. The present invention, however, is not limited to the example embodiments described below. Further, in each drawing, the same or corresponding elements are appropriately designated by the same reference signs. It should also be noted that the drawings are schematic, and the dimensional relationships and the ratios between the elements may differ from the actual ones. The dimensional relationships and the ratios between drawings may also be different in some sections.
The following describes a homomorphic cyclic operation system relating to a first example embodiment with reference to
The homomorphic cyclic operation system 100 relating to the first example embodiment shown in
Further, the homomorphic cyclic operation apparatus 120 shifts the periodic array of data without decrypting it. Therefore, an output of the homomorphic cyclic operation apparatus 120 is also a ciphertext. There are various ways to use the obtained ciphertext, as illustrated by the example embodiments below. It is preferred that a decryption apparatus for decrypting the obtained ciphertext be provided separately from the homomorphic cyclic operation apparatus 120 because the secret and public keys of homomorphic encryption can be managed separately by different apparatuses with increased security.
The homomorphic encryption used in the first example embodiment can encrypt a data array and has a homomorphic operation defined with respect to at least one multiplication. Further, it is preferable that homomorphic operations be also defined for addition, although it is not directly used in the example embodiment. In other words, in the homomorphic encryption used in the first example embodiment, homomorphic addition and homomorphic multiplication that satisfy the following relational expressions are defined:
HomAdd(Enc(m),Enc(m′))=Enc(m+m′) Homomorphic Addition
HomMu1(Enc(m),Enc(m′))=Enc(m*m′) Homomorphic Multiplication
Next, with reference to
In step S1, the encryption apparatus 110 encrypts a periodic array of data by storing it in the coefficients of an indeterminate polynomial to generate a ciphertext of periodic data. The encryption apparatus 110 transmits the generated ciphertext of the period data to the homomorphic cyclic operation apparatus 120.
In step S2, the homomorphic cyclic operation apparatus 120 shifts the periodic array of data in the ciphertext of the periodic data by applying the indeterminate raised to the power of a shift amount to the ciphertext of the periodic data received from the encryption apparatus 110.
There are various ways of using the ciphertext obtained in the step S2, as illustrated by the example embodiments below.
An information processing apparatus (computer) employing the hardware configuration shown in
As shown in
The CPU 11 executes each instruction included in the homomorphic cyclic operation program executed by the homomorphic cyclic operation apparatus 120. The primary storage device 12 is, for instance, a RAM (Random Access Memory) and temporarily stores various programs such as the homomorphic cyclic operation program executed by the homomorphic cyclic operation apparatus 120 so that the CPU 11 can process the programs.
The auxiliary storage device 13 is, for instance, an HDD (Hard Disk Drive) and is capable of storing the various programs, such as the homomorphic cyclic operation program executed by the homomorphic cyclic operation apparatus 120, in the medium to long term. The various programs such as the homomorphic cyclic operation program may be provided as a program product stored in a non-transitory computer-readable storage medium. The auxiliary storage device 13 can be used to store the various programs such as the homomorphic cyclic operation program stored in the non-transitory computer-readable storage medium in the medium to long term. The IF part 14 provides an interface to the input and output between, for instance, the homomorphic cyclic operation apparatus 120 and the encryption apparatus 110.
The information processing apparatus employing the hardware configuration 10 described above achieves the functions of the homomorphic cyclic operation apparatus 120 by executing the homomorphic cyclic operation method described above as a program.
The homomorphic cyclic operation system in the first example embodiment is thus able to contribute to shifting data storage locations without decrypting a periodic array of encrypted data. Further, the homomorphic cyclic operation system in the first example embodiment can be implemented as a homomorphic cyclic operation method, and the homomorphic cyclic operation method in the first example embodiment can be implemented as a program executed by an information processing apparatus (computer) having the hardware configuration described above.
The following describes a homomorphic cyclic operation system relating to a second example embodiment. The second example embodiment describes a method for performing a homomorphic cyclic operation on a periodic array of data while using an example of the homomorphic encryption used in the first example embodiment. The homomorphic encryption described below is capable of encrypting a data array and has a homomorphic operation defined with respect to at least one multiplication.
First, one cycle of a periodic array of data can be regarded as a vector. Then, a vector a=(a0, a1, . . . , an−1) and a polynomial a(x)=Σi=0n−1ai*xi can be equated. For the vector a=(a0, a1, . . . , an−1) and a vector b=(b0, b1, . . . , bn−1), this equation results in defining a multiplication a(x)*b(x) as a polynomial and an inner product <a, b>=Σi=0n−1 ai*bi as a vector.
Then, a noise vector u=(u0, u1, . . . , un−1) is prepared. ui (i=0, 1, . . . , n−1) is one of {0, 1, −1}. The probability of ui=0 is q, the probability of ui=1 is (1−q)/2, and the probability of ui=−1 is (1−q)/2.
Using this noise vector u=(u0, u1, . . . , un−1), a ciphertext of a plaintext vector m=(m0, m1, . . . , mn−1) is defined as follows:
Note that, in the above definition of the ciphertext, t is the plaintext space size, d is the ciphertext space size, and r is the base that satisfies rn=−1 mod d. Further, [ ]d is a reduction to an interval [−d/2, d/2), that is, a reduction such that the remainder when divided by d is included in the interval [−d/2, d/2).
If the noise vector u=(u0, u1, . . . , un−1) and the plaintext vector m=(m0, m1, . . . , mn−1) are respectively regarded as a polynomial u(x)=Σi=0n−1 ui*xi and a polynomial m(x)=Σi=0n−1 mi*xi, the ciphertext above can be expressed as follows:
Next, we will demonstrate the ciphertext defined as above is homomorphic encryption.
For ciphertexts Enc(m(x)) and Enc(m′(x)) of the plaintext vectors m(x) and m′(x) expressed as polynomials, additive homomorphism holds as shown below.
[Enc(m(x))+Enc(m′(x))]d=[[m(r)+t*u(r)]d+[m′(r)+t*u′(r)]d]d=[[m(r)+m′(r)+t*(u(r)+u′(r))]d=Enc(m(x)+m′(x)mod t)
Here, note that mod t is absorbed by t*(u(r)+u′(r)) when each coefficient of m(r)+m(r) becomes larger than t.
For the ciphertexts Enc(m(x)) and Enc(m′(x)) of the plaintext vectors m(x) and m′(x) expressed as polynomials, multiplicative homomorphism holds as shown below.
[Enc(m(x))*Enc(m′(x))]d=[[m(r)+t*u(r)]d*[m′(r)+t*u′(r)]d]d=[(m(r)+t*u(r))*(m′(r)+t*u′(r))]d=[m(r)*m′(r)+t*(m(r)*u′(r)+m′(r)*u(r)+t*u(r)*u′(r))]d=[m(r)*m′(r)+t*u″(r)mod rn+1]d=Enc(m(x)*m′(x)mod(t,xn+1))
Note that, as a transformation of the above, u″(r)=m(r)*u′(r)+m′(r)*u(r)+t*u(r)*u′(r). Also note that rn=−1 mod d. Further, f(x) mod (t, xn+1) represents f(x) mod t mod (xn+1). In other words, f(x) is converted to a polynomial f′ (x) of a degree smaller than n using the relationship xn=−1, and f(x) mod t mod (xn+1) is a polynomial of the remainders obtained by dividing the coefficients of f′(x) by t.
For the plaintext vector m=(m0, m1, . . . , mn−1), an inner product vector m2=(m20, m21, . . . , m2n−1)=(m0, −mn−1, −mn−2, . . . , −m1) is prepared. An inner product ciphertext Enc2(m) is defined as Enc(m2), and a polynomial having the inner product vector m2 as a coefficient is defined as m2(x). At this time, for the ciphertext Enc(m(x)) of the plaintext vector m(x) expressed as a polynomial and an inner product ciphertext Enc2(m′(x)) of the plaintext vector m′(x), the following holds true:
HomMu1(Enc(m(x)),Enc2(m′(x)))=Enc(m(x)*m2′(x)mod(t,xn+1))=Enc(<m,m′>+m″(x)mod t)
This is because, if we note that xn=−1, Σi=1n−1−mi*m′i*xn=Σi=1n−1 mi*m′i, so the following computation holds true:
m(x)=m0+m1*x+m2*x2+ . . . +mn−1*xn−1×m2′(x)=m′0−m′1*xn−1−m′2*xn−2− . . . −m′n−1*x1=m0*m′0+Σi=1n−1−mi*m′i*xn+m″(x)=Σi=0n−1mi*m′i+m″(x)=<m,m′>+m″(x)
The Homomorphic operations above enable shifting the periodic array of data in the ciphertext Enc(m(x)) of the periodic data m(x) by homomorphically multiplying Enc(xs) obtained by encrypting the indeterminate x raised to the power of a shift amount s, i.e., xs, by the ciphertext Enc(m(x)) of the periodic data m(x). This is because the following relational expression holds true:
HomMu1(Enc(m(x)),Enc(xs))=Enc(m(x)*xs mod(t,xn+1))=Enc((m>>_s)mod t)
Note that, in the above equation, >>_ represents a negative cyclic operation (cyclic operation that multiplies the data by −1 when performing a shift) that shifts the vector to the right. In other words, when the ciphertext of the plaintext vector m=(m0, m1, . . . , mn−1) is Enc(m) and the shift amount is s, a ciphertext HomCycle(Enc (m), s) after the shifting is obtained as follows in the above homomorphic cyclic operation:
HomCycle(Enc(m),s)=Enc((−mn−s, . . . ,−mn−1,m0, . . . ,mn−1−s))
Note that, in the homomorphic cyclic operation above, the data is multiplied by −1 during the shifting, but as can be seen from the example embodiments described later, there is no problem in practical use. Further, the homomorphic cyclic operation described above in combination with the homomorphic cyclic operation system, the homomorphic cyclic operation apparatus, the homomorphic cyclic operation method, and the homomorphic cyclic operation program of the first example embodiment realize the homomorphic cyclic operation system, a homomorphic cyclic operation apparatus, a homomorphic cyclic operation method, and a homomorphic cyclic operation program of the second example embodiment.
The following describes an improvement on the homomorphic cyclic operation in the second example embodiment. Since a homomorphic cyclic operation in a third example embodiment can use homomorphic operations different from the encryption and the homomorphic cyclic operation in the second embodiment, the following description of the third example embodiment only discusses the homomorphic cyclic operation in the third example embodiment.
The homomorphic cyclic operation in the third example embodiment shifts the periodic array of data in the ciphertext Enc(m(x)) of the periodic data m(x) by scalar multiplying the ciphertext Enc(m(x)) of the periodic data m(x) by a value obtained by substituting the base r for the indeterminate x raised to the power of the shift amount s, i.e., rs.
More concretely, for the ciphertext Enc(m(x)) of the plaintext m(x) expressed as a polynomial, the homomorphic cyclic operation with the shift amount s can be computed as follows. Note that, as a transformation of the below, u′(r))=u(r)*rs.
[Enc(m(x))*rs]d=[[m(r)+t*u(r)]d*rs]d=[m(r)*rs+t*u(r)*rs]d=[m0*rs+m1*r1+s+ . . . +mn−1*rn−1+s+t*u′(r)]d=[−mn−s+(−mn−s+1)*r+ . . . +(−mn−1)*rs−1+m0*rs+m1*rs+1+ . . . +mn−s−1*rn−1+t*u′(r)]d=Enc((m>>_s)mod t)
Note that, since r−1=−rn−1 mod d from rn=−1 mod d, if the shift amount s is negative, the cyclic operation is negative with a shift to the left.
The following describes the difference between the homomorphic cyclic operation in the second example embodiment and that in the third example embodiment.
Since the homomorphic cyclic operation in the second example embodiment computes HomMu1(Enc(m(x)), Enc(xs)), Enc(xs) needs to be stored or computed every time. Meanwhile, since ri used in the homomorphic cyclic operation in the third example embodiment is also used in the encryption, it is often computed in advance and the computation result is stored in memory. In this case, no additional storage and computational costs are incurred because the computed ri can be reused.
Moreover, even if one ends up having to compute ri used in the homomorphic cyclic operation in the third example embodiment because it cannot be reused, the cost of computing ri is smaller than the cost of computing Enc(xs). This is because ri is included in the definition of the encryption Enc(m)=[Σi=0n−1 (mi+t*ui)*ri]d.
Further, the homomorphic cyclic operation in the second example embodiment brings about an increase in noise that may cause a decoding error when the homomorphic multiplication HomMu1 is used. Here, the increase in noise means an increased absolute value of the coefficient of the polynomial u(x) corresponding to u(r) in the ciphertext Enc(m(x))=[m(r)+t*u(r)]d. Meanwhile, in the homomorphic cyclic operation in the third example embodiment, the noise after the homomorphic cyclic operation is u′(r)=u(r)*rs, which is a polynomial having the corresponding u>>_s as a coefficient. Although the signs of the shifted elements are inverted, the absolute value of the coefficient remains the same. Therefore, no increase in noise occurs.
In other words, as compared with the homomorphic cyclic operation in the second example embodiment, the homomorphic cyclic operation in the third example embodiment has the advantage of having a lower additional memory or computational cost and a lower overall cryptographic computational cost stemming from an increased decoding error probability or larger encryption scheme parameters to address it.
Further, the homomorphic cyclic operation in the third example embodiment in combination with the homomorphic cyclic operation system, the homomorphic cyclic operation apparatus, the homomorphic cyclic operation method, and the homomorphic cyclic operation program of the first example embodiment are also able to realize a homomorphic cyclic operation system, a homomorphic cyclic operation apparatus, a homomorphic cyclic operation method, and a homomorphic cyclic operation program of the third example embodiment.
The homomorphic cyclic operation described above is a negative cyclic operation that multiplies the data by −1 when performing a shift. Using similarity calculation as an example, the fourth example embodiment describes how even the negative cyclic operation that multiplies the data by −1 when performing a shift can be put to practical use with some ingenuity. Even the negative cyclic operation that multiplies data by −1 when performing a shift by encrypting a periodic array of data by storing it in the coefficients of an indeterminate polynomial after making the periodic array of data periodically redundant is able to calculate similarity accurately.
Then, one can calculate the similarity applying an inner product operation to the score table. For instance, in the example shown in
The similarity can be calculated by performing an inner product operation on these two arrays A and B as vectors. Since the inner product operation here can use a homomorphic operation as explained above, one can calculate the similarity while keeping the structures of the heterocyclic compounds A and B secret.
Meanwhile, since heterocyclic compounds are cyclically structured, the value of the similarity between two given compounds changes depending on the starting point from which the similarity calculation is performed. As a matter of fact, although the heterocyclic compounds A and B are the same heterocyclic compounds, the calculated similarity above is low because the starting points of their cyclic structures are different. Without a homomorphic cyclic operation, it is necessary to repeatedly encrypt the data of the heterocyclic compounds as many times as the number of possible combinations of the starting points of the cyclic structures. A homomorphic cyclic operation enables changing the starting point in an encrypted state after the starting point of a cyclic structure is set to any one point and the data is encrypted.
Since the homomorphic cyclic operation described above, however, is a negative cyclic operation that multiplies the data by −1 when performing a shift, problems arise in the following two cases:
For instance, as shown below, when the dimensionality of a plaintext handled by homomorphic encryption differs from the length of the vector to be encrypted, the remaining dimensions are filled with zeros. In this case, the correct result cannot be obtained from a homomorphic inner product operation.
For instance, as shown below, even if the dimensionality of a plaintext handled by homomorphic encryption is the same as the length of the vector to be encrypted, a value obtained from multiplication by −1 is used for calculation since a negative shift is performed. As a result, the correct result cannot be obtained from a homomorphic inner product operation.
Therefore, the homomorphic cyclic operation of the fourth example embodiment encrypts a periodic array of data by storing it in the coefficients of an indeterminate polynomial after making the periodic array of data periodically redundant. As a result, the homomorphic cyclic operation of the fourth example embodiment is able to accurately perform a homomorphic inner product operation, even if it is a negative cyclic operation that multiplies the data by −1 when performing a shift, thereby being able to accurately calculate similarity. Further, as can be seen from the example below, the portions of the other vector that correspond to the periodically redundant portions are filled with zeros. Note that the redundant portions are indicated by white numbers.
Further, even when the dimensionality of a plaintext handled by homomorphic encryption is the same as the length of the vector to be encrypted, by encrypting a periodic array of data by storing it in the coefficients of an indeterminate polynomial after making the periodic array of data periodically redundant, even a negative cyclic operation that multiplies the data by −1 when performing a shift can accurately perform a homomorphic inner product operation, thereby being able to accurately calculate similarity.
The following describes in more detail the homomorphic cyclic operation of the fourth example embodiment. The description below refers to the encryption apparatus 110 and the homomorphic cyclic operation apparatus 120 discussed in the description of the first example embodiment, however, the apparatus configuration is not necessarily limited thereto.
First, as a premise, each element is encoded using 0 to 1-1. The size of the score space is ssize, and the length of the periodic array of data is rsize. The cyclic operation here allows both left and right shifts, the amount of a left shift is set to sl, and the amount of a right shift sr. Further, the i-th row of the score table below is regarded as a vector Ti.
Taking a security parameter as an input, generate a public key pk and a secret key sk for a somewhat homomorphic encryption scheme that can treat an n−1 degree polynomial having a coefficient space size s>ssize as a plaintext, where n≥(rsize+sl+sr)×1. Here, s>ssize signifies the ability to handle all potential scores that may be outputted. Further, the condition n≥(rsize+sl+sr)×1 is required to encrypt the length of a vector to be encrypted.
In the registration phase, with the public key pk and a periodic array (vector) of data x=(x0, x1, . . . , xr_size−1) as inputs, the following computation is performed. Note that, although this process is typically performed by the encryption apparatus 110, the apparatus used is not limited as long as the process can be registered in the homomorphic cyclic operation apparatus 120 in advance.
indicates data missing or illegible when filed
In the query phase, the encryption apparatus 110 takes the public key pk and a periodic array (vector) of data y=(y0, y1, . . . , yr_size−1) as inputs and performs the following computation:
indicates data missing or illegible when filed
In the similarity calculation phase, the homomorphic cyclic operation apparatus 120 takes the public key pk, the ciphertext c1 generated during the registration, and the ciphertext c2 generated during the query as inputs and performs the following computation:
Note that the calculations of a and b in the similarity calculation above may be c=HomCycle(c2, l*j) and cip=HomIPp k (c, c1). Further, the calculations from c to e in the similarity calculation above are for masking in order to prevent information leakage from non-constant terms in the homomorphic inner product operation. Therefore, these calculations may be omitted when there is no need to prevent information leakage.
In the decryption phase, the encryption apparatus 110 takes the secret key sk and the ciphertext set C generated during the similarity calculation as inputs and performs the following computation:
Although the homomorphic cyclic operation described in the second and the third example embodiments is a negative cyclic operation that multiplies the data by −1 when performing a shift, the above description has shown that they can be used to calculate similarity with modification. It should be noted that similarity calculation is merely an example to which a negative cyclic operation that multiplies the data by −1 when performing a shift can be applied and that the application examples of the homomorphic cyclic operation described in the second and the third example embodiment are not limited thereto.
Further, the homomorphic cyclic operation in the fourth example embodiment in combination with the homomorphic cyclic operation system, the homomorphic cyclic operation apparatus, the homomorphic cyclic operation method, and the homomorphic cyclic operation program of the first example embodiment are also able to realize a homomorphic cyclic operation system, a homomorphic cyclic operation apparatus, a homomorphic cyclic operation method, and a homomorphic cyclic operation program of the fourth example embodiment. Therefore, the homomorphic cyclic operation system, the homomorphic cyclic operation apparatus, the homomorphic cyclic operation method, and the homomorphic cyclic operation program of the fourth example embodiment are suitable for calculating the similarity between periodic arrays of data.
The following describes another application example of the homomorphic cyclic operations discussed in the second and the third example embodiment. A homomorphic cyclic operation in a fifth example embodiment is used for secure function evaluation. The following description refers to the encryption apparatus 110 and the homomorphic cyclic operation apparatus 120 discussed in the description of the first example embodiment, however, the apparatus configuration is not necessarily limited thereto.
The secure function evaluation is a process where a ciphertext Enc(m) of data m is registered in a database server, and while keeping a polynomial function with integer coefficients f(x)=a0+a1*x+a2*x2+ . . . +aN*xN hidden in the database, a user computes a function evaluation value f(m)=a0+a1*m+a2*m2+ . . . +aN*mN. Note that it is permissible to publicly disclose the degree N of the polynomial to be evaluated and a secret key will be provided to the user through another secure means.
First, secure function evaluation that does not use any homomorphic cyclic operation will be described for comparison. This secure function evaluation without a homomorphic cyclic operation employs Horner's rule and utilizes the fact that f(x)=a0+a1*x+a2*x2+ . . . +aN*xN can be written as f(x)=a0+x*(a1+x*(a2+ . . . x(aN−1+x*aN))). It is known that this Horner's rule allows for evaluating an n-degree polynomial with the minimum number of addition and multiplication operations.
As can be seen from the computation above, in the secure function evaluation using the Horner's rule, for the degree N of the polynomial to be evaluated, the user calculates and sends the N+1 ciphertexts Enc(a0), Enc(a1), . . . , Enc(aN) to the database server. Therefore, as the degree N of the polynomial to be evaluated increases, both the user's encryption cost and the communication volume between the database servers will increase.
Even when the degree N of the polynomial to be evaluated is large, using a homomorphic cyclic operation will prevent the user's encryption cost and the communication volume between the database servers from increasing.
More concretely, the user calculates the function evaluation value f(m)=a0+a1*m+a2*m2+ . . . +aN*mN while keeping the polynomial function f(x)=a0+a1*x+a2*x2+ . . . +aN*xN hidden in the database server as follows:
Now we will compare the secure function evaluation method (Horner's rule) without using a homomorphic cyclic operation with the secure function evaluation method using homomorphic cyclic operations according to the fifth example embodiment. The table below compares the secure function evaluation method (Horner's rule) without a homomorphic cyclic operation with the secure function evaluation method using homomorphic cyclic operations according to the fifth example embodiment. Note that the calculation costs of HomMu1 and HomCycle are the same, and so are the calculation costs of Enc and Enc2. The calculation costs can be compared by comparing the number of processes.
As evident from the comparison table above, the secure function evaluation using homomorphic cyclic operations according to the fifth example embodiment requires less encryption computational cost and less communication volume from the user to the database server than the secure function evaluation that does not use a homomorphic cyclic operation. On the other hand, the computational cost of the homomorphic processing performed by the database server is higher in the secure function evaluation using homomorphic cyclic operations according to the fifth example embodiment than in the secure function evaluation without homomorphic cyclic operations. Therefore, the secure function evaluation using homomorphic cyclic operations according to the fifth example embodiment can be effectively utilized in cases where the user's terminal (the encryption apparatus 110) is underpowered, for example.
Further, the homomorphic cyclic operation in the fifth example embodiment in combination with the homomorphic cyclic operation system, the homomorphic cyclic operation apparatus, the homomorphic cyclic operation method, and the homomorphic cyclic operation program of the first example embodiment are also able to realize a homomorphic cyclic operation system, a homomorphic cyclic operation apparatus, a homomorphic cyclic operation method, and a homomorphic cyclic operation program of the fifth example embodiment. Therefore, the homomorphic cyclic operation system, the homomorphic cyclic operation apparatus, the homomorphic cyclic operation method, and the homomorphic cyclic operation program of the fifth example embodiment are suitable for performing secure function evaluation.
Some or all of the example embodiments above can be described as (but not limited to) the following Supplementary Notes.
A homomorphic cyclic operation system performing a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, the homomorphic cyclic operation system comprising:
an encryption apparatus that encrypts the periodic array of data by storing it in the coefficients of an indeterminate polynomial to generate a ciphertext of periodic data; and
a homomorphic cyclic operation apparatus that shifts the periodic array of data in the ciphertext of the periodic data by applying the indeterminate raised to the power of a shift amount to the ciphertext of the periodic data.
The homomorphic cyclic operation system according to Supplementary Note 1, wherein
the homomorphic cyclic operation apparatus shifts the periodic array of data in the ciphertext of the periodic data by homomorphically multiplying a value obtained by encrypting the indeterminate raised to the power of the shift amount by the ciphertext of the periodic data.
The homomorphic cyclic operation system according to Supplementary Note 1, wherein
the homomorphic cyclic operation apparatus shifts the periodic array of data in the ciphertext of the periodic data by scalar multiplying the ciphertext of the periodic data by the indeterminate substituted by the base raised to the power of the shift amount.
The homomorphic cyclic operation system according to Supplementary Note 3, wherein
the base r is a number that satisfies rn≡−1 mod d when a cycle n of the array and a ciphertext space size d are used.
The homomorphic cyclic operation system according to any one of Supplementary Notes 1 to 4, wherein
the encryption apparatus adds a noise vector to the periodic array of data before encrypting the periodic array of data by storing it in the coefficients of an indeterminate polynomial.
The homomorphic cyclic operation system according to any one of Supplementary Notes 1 to 5, wherein
the encryption apparatus makes the periodic array of data periodically redundant before encrypting the periodic array of data by storing it in the coefficients of an indeterminate polynomial.
The homomorphic cyclic operation system according to any one of Supplementary Notes 1 to 5, wherein
the periodic array represents the coefficients of an evaluation polynomial to be evaluated by substituting values for evaluation purposes,
the encryption apparatus encrypts the coefficients of the evaluation polynomial, and
the homomorphic cyclic operation apparatus obtains a ciphertext of the evaluation polynomial substituted with the values for evaluation purposes by repeatedly shifting by one a ciphertext obtained by encrypting the values for evaluation purposes, repeatedly multiplying the ciphertext by itself, and calculating the inner product of the result of the shifting and the multiplying and a ciphertext of the coefficients of the evaluation polynomial.
A homomorphic cyclic operation apparatus performing a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, wherein
the homomorphic cyclic operation apparatus shifts the periodic array of data in a ciphertext of periodic data by encrypting the periodic array of data by storing it in the coefficients of an indeterminate polynomial to generate the ciphertext and applying the indeterminate raised to the power of a shift amount to the ciphertext.
A homomorphic cyclic operation method performing a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, the homomorphic cyclic operation method comprising:
a step of encrypting the periodic array of data by storing it in the coefficients of an indeterminate polynomial to generate a ciphertext of periodic data; and
a step of shifting the periodic array of data in the ciphertext of the periodic data by applying the indeterminate raised to the power of a shift amount to the ciphertext of the periodic data.
A program causing a computer to perform a homomorphic cyclic operation on a periodic array of data using homomorphic encryption having a homomorphic operation defined with respect to at least one multiplication, wherein
the program shifts the periodic array of data in a ciphertext of periodic data by applying the indeterminate raised to the power of a shift amount to the ciphertext, wherein the ciphertext of the periodic data is encrypted by storing it in the coefficients of an indeterminate polynomial.
Further, the disclosure of Non-Patent Literature cited above is incorporated herein in its entirety by reference thereto. It is to be noted that it is possible to modify or adjust the example embodiments or examples within the scope of the whole disclosure of the present invention (including the Claims) and based on the basic technical concept thereof. Further, it is possible to variously combine or select (or partially omit) a wide variety of the disclosed elements (including the individual elements of the individual claims, the individual elements of the individual example embodiments or examples, and the individual elements of the individual figures) within the scope of the whole disclosure of the present invention. That is, it is self-explanatory that the present invention includes any types of variations and modifications to be done by a skilled person according to the whole disclosure including the Claims and the technical concept of the present invention. Particularly, any numerical ranges disclosed herein should be interpreted that any intermediate values or subranges falling within the disclosed ranges are also concretely disclosed even without specific recital thereof. In addition, using some or all of the disclosed matters in the literatures cited above as necessary, in combination with the matters described herein, as part of the disclosure of the present invention in accordance with the object thereof shall be considered to be included in the disclosed matters of the present application.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2021/028209 | 7/29/2021 | WO |
