Cryptographic method, systems and services for evaluating univariate or multivariate real-valued functions on encrypted data
The invention relates to a cryptographic method and variants thereof based on homomorphic encryption enabling the evaluation of real-valued functions on encrypted data, in order to allow carrying out homomorphic processing on encrypted data more broadly and efficiently.
1. A cryptographic method executed in a digital form by at least one information processing system, the method comprising storing, by a user, encrypted data on a server, enabling a third-party to perform operations on the encrypted data, the operations comprising an evaluation of one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q , each of the functions taking as input one or more real-valued variables from among variables x 1 , . . . , x p , and at least one of the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q taking as input at least two variables, the method comprising: taking as input, from the encrypted data, ciphertexts of encryptions E(encode(x i )) of each of the inputs x i , with 1≤i≤p, and returning a plurality of ciphertexts of encryptions of the one or more multivariate real-valued functions ƒ 1 , . . . , ƒ q applied at their respective inputs, where E is a homomorphic encryption algorithm and encode is an encoding function which associates to each of the variables x i an element of a native space of cleartexts of E, wherein the method further comprises:
a. a pre-calculation step comprising transforming the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q into a network of real-valued univariate functions, the network comprising sums and compositions of univariate functions,
b. a pre-selection step comprising identifying in the network of univariate functions redundancies of any one of three types:
same univariate functions applied to a same argument,
different univariate functions applied to a same argument,
same univariate functions applied to arguments differing by a non-zero additive constant,
c. a step of homomorphic evaluation of the network of univariate functions, wherein at least part of the univariate functions in the network is reused an evaluated in a shared manner according to the redundancies selected in the pre-selection step.
2. The cryptographic method according to claim 1 , wherein for at least one function ƒ j from among the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q , the transforming of the pre-calculation step is an approximate transformation in the form
f
j
(
x
j
1
,
…
,
x
j
t
)
≈
∑
k
=
0
K
g
k
(
∑
i
=
1
t
a
i
,
k
x
j
i
)
with t≤p and j 1 , . . . , j t ∈{1, . . . , p}, and where the coefficients a i,k are real numbers and where the g are univariate functions defined on reals and with real value, said functions g and said coefficients a i,k being determined as a function of ƒ j , for a given parameter K.
3. The cryptographic method according to claim 1 , wherein for at least one function ƒ j from among the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q , the transforming of the pre-calculation step is an approximate transformation in the form
f
j
(
x
j
1
,
…
,
x
j
t
)
≈
∑
k
=
0
K
g
k
(
x
-
a
k
)
with x=(x j 1 , . . . , x j t ), a k =(a 1,k , . . . , a t,k ), t≤p and j 1 , . . . , j t ∈{1, . . . , p}, and where the vectors a k have as coefficients a i,k real numbers and where the g k are univariate functions defined on reals and with real value, said functions g k and said coefficients a i,k being determined as a function of ƒ j , for a given parameter K and a given norm ∥·∥.
4. The cryptographic method according to claim 2 , wherein the coefficients a i,k are fixed.
5. The cryptographic method according to claim 1 , wherein for at least one function ƒ j from among the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q , the transforming of the pre-calculation step is an approximate transformation in the form
f
j
(
x
j
1
,
…
,
x
j
t
)
≈
∑
k
=
0
K
g
k
(
∑
i
=
1
t
λ
j
i
Ψ
(
x
j
i
+
ka
)
)
with t≤p and j 1 , . . . , j t ∈{1, . . . , p}, and where Ψ is a univariate function defined on reals and with real value, where the λ j i are real constants and where the g are univariate functions defined on reals and with real value, the functions g k being determined as a function of ƒ 1 , for a given parameter K.
6. The cryptographic method according to claim 1 , wherein the transforming of the pre-calculation step uses a formal equivalence max(z 1 , z 2 )=z 2 +(z 1 −z 2 ) + to express a function (z 1 , z 2 ) max(z 1 , z 2 ) as a combination of sums and compositions of univariate functions.
7. The cryptographic method according to claim 1 , wherein the transforming of the pre-calculation step uses a formal equivalence min (z 1 , z 2 )=z 2 +(z 1 −z 2 ) − to express a function (z 1 , z 2 ) min(z 1 , z 2 ) as a combination of sums and compositions of univariate functions.
8. The cryptographic method according to claim 1 , wherein the transforming of the pre-calculation step uses a formal equivalence z 1 ×z 2 =(z 1 +z 2 ) 2 /4−(z 1 −z 2 ) 2 /4 to express a function (z 1 , z 2 ) z 1 ×z 2 as a combination of sums and compositions of univariate functions.
9. The cryptographic method according to claim 1 , wherein the transforming of the pre-calculation step uses a formal equivalence |z 1 ×z 2 |=exp(ln|z 1 |+ln|z 2 |) to express a function (z 1 , z 2 ) |z 1 ×z 2 | as a combination of sums and compositions of univariate functions.
10. The cryptographic method according to claim 6 , wherein the function includes three variables or more, and the formal equivalence is obtained from an iteration of the formal equivalence for two variables.
11. The cryptographic method according to claim 1 , including in the step of homomorphic evaluation of the network of univariate functions, a sub-process for approximate homomorphic evaluation of at least one univariate function ƒ of a real-valued variable x of the functions in the network with an arbitrary accuracy in a domain of definition and with a real value in an image , taking as input a ciphertext of an encryption of x, E(encode(x)), and returning a ciphertext of an encryption of an approximate value of ƒ(x), E′(encode′(y)) with y≈ƒ(x), where E and E′ are homomorphic encryption algorithms a respective native space of cleartexts of which is and
said sub-method being parameterised by:
an integer N≥1 quantifying an actual accuracy of the representation of the variables at the input of the function ƒ to be evaluated,
an encoding function encode taking as input an element of the domain and associating thereto an element of
an encoding function encode′ taking as input an element of the image and associating thereto an element of
a discretisation function discretise taking as input an element of and associating thereto an index represented by an integer,
a homomorphic encryption scheme having an encryption algorithm H , a native space of the cleartexts of which H has a cardinality of at least N,
an encoding function encode H taking as input an integer and returning an element of H ,
so that the image of the domain the encoding encode followed by the discretisation discretise (discretise∘encode) is a set of at most N indices selected from ={0, . . . , N−1},
the method further comprising:
a. a step of pre-calculating a table corresponding to said univariate function ƒ, comprising
decomposing the domain into N selected sub-intervals R 0 , . . . , R N−1 whose union makes up
for each index i in ={0, . . . , N−1}, determining a representative x(i) in the sub-interval R i and calculating the value y(i)=ƒ(x(i))
returning the table T consisting of the N components T[0], . . . , T[N−1], with T[i]=y(i) for 0≤i≤N−1
b. a step of homomorphic evaluation of the table comprising
converting the ciphertext E(encode(x)) into the ciphertext H (encode H ) for an integer having as an expected value the index i=(discretise∘encode)(x) in the set ={0, . . . , N−1} if x∈R i
obtaining the ciphertext E′(encode′(T ) ˜ ) for an element encode′(T ) ˜ having as an expected value encode (T ), based on the ciphertext H (encode H ( )) and the table T
returning E′(encode′(T ) ˜ ).
12. The cryptographic method according to claim 11 , wherein
a domain of definition of the function ƒ to be evaluated is given by the real interval =[x min , x max ),
N intervals R i (for 0≤i≤N−1) covering the domain are the semi-open sub-intervals
R
i
=
[
i
N
(
x
max
-
x
min
)
+
x
min
,
i
+
1
N
(
x
max
-
x
min
)
+
x
min
)
,
splitting in a regular manner.
13. The cryptographic method according to claim 11 , wherein the set is a subset of the additive group M for an integer M≥N.
14. The cryptographic method according to claim 13 , wherein the group M is represented in a multiplicative manner as powers of a M-th primitive root of the unit denoted X, so that to the element i of M is associated the element X i ; all of the M-th roots of the unit {1, X, . . . , X M−1 } forming a group isomorphic with M for the multiplication modulo (X M −1).
15. The cryptographic method according to claim 11 , wherein the homomorphic encryption algorithm E is given by an LWE-type encryption algorithm applied to the torus = and has as a native space of the cleartexts =
16. The cryptographic method according to claim 15 , parameterised by an integer M≥N wherein
the encoding function encode has its image contained in the sub-interval
[
0
,
N
M
-
1
2
M
)
of the torus, and
the discretisation function discretise applies an element t of the torus to the rounded integer of the product M×t modulo M, where M×t is calculated in in mathematical form:
discretise: → , t discretise( t )=┌ M×t ┘ mod M.
17. The cryptographic method according to claim 16 , wherein the domain of definition of the function ƒ is the real interval =[x min , x max ), and the encoding function encode is
encode
:
[
x
min
,
x
max
)
→
[
0
,
N
M
-
1
2
M
)
,
x
↦
encode
(
x
)
=
2
N
-
1
2
M
x
-
x
min
x
max
-
x
min
.
18. The cryptographic method according to claim 15 , wherein the homomorphic encryption algorithm H is an LWE-type encryption algorithm and the encoding function encode H is the identity function.
19. The cryptographic method according to claim 15 , parameterised by an even integer M and wherein the homomorphic encryption algorithm H is an RLWE-type encryption algorithm and the encoding function encode H is the function encode H : M → M/2 [X], i encode H (i)=X −i ·p(X) for an arbitrary polynomial p of M/2 [X].
20. The cryptographic method according to claim 18 , parameterised by an even integer M equal to 2N, and wherein an LWE-type ciphertext E′(encode′(T )) on the torus is extracted from an RLWE ciphertext approaching the polynomial X ·q(X)∈ N [X], with
q
(
X
)
=
T
′
[
0
]
+
T
′
[
1
]
X
+
…
+
T
′
[
N
-
1
]
X
N
-
1
=
∑
j
=
0
N
-
1
T
′
[
j
]
X
j
in N [X] and where T′[j]=encode′(T[j]), 0≤j≤N−1.
21. The cryptographic method according to claim 11 , wherein the image of said at least one function ƒ is the real interval =[y min , y max ), and
the homomorphic encryption algorithm E′ is given by an LWE-type encryption algorithm applied to the torus = and has as a native space of the cleartexts = ,
the encoding function encode′ is
encode
′
:
[
y
min
,
y
max
→
𝕋
,
y
↦
encode
′
(
y
)
=
y
-
y
min
y
max
-
y
min
.
22. The cryptographic method according to claim 1 , wherein the input encrypted data are derived from a prior re-encryption step so as to be set in the form of ciphertexts of encryptions of said homomorphic encryption algorithm E.
23. An information processing system comprising a hardware processor programmed to implement a homomorphic evaluation cryptographic method, the method comprising storing, by a user, encrypted data on a server, enabling a third-party to perform operations on the encrypted data, the operations comprising an evaluation of one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q , each of the functions taking as input one or more real-valued variables from among variables x 1 , . . . , x p , and at least one of the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q taking as input at least two variables, the method comprising
taking as input, from the encrypted data, ciphertexts of encryptions E(encode(x i )) of each of the inputs x i , with 1≤i≤p, and returning a plurality of ciphertexts of encryptions of the one or more multivariate real-valued functions ƒ 1 , . . . , ƒ q applied at their respective inputs, where E is a homomorphic encryption algorithm and encode is an encoding function which associates to each of the variables x i an element of a native space of cleartexts of E,
wherein the method further comprises:
a. a pre-calculation step comprising transforming the one of more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q into a network of real-valued univariate functions, the network comprising sums and compositions of the univariate functions,
b. a pre-selection step comprising identifying in the network of univariate functions redundancies of any one of three types:
same univariate functions applied to a same argument,
different univariate functions applied to a same argument,
same univariate functions applied to arguments differing by a non-zero additive constant,
c. a step of homomorphic evaluation of the network of univariate functions, wherein at least part of the univariate functions in the network is reused and evaluated in a shared manner according to the redundancies selected in the pre-selection step.
24. Non-transient computer media configured to be loaded and implemented by an information processing system, the non-transient computer media implementing a homomorphic evaluation cryptographic method, the method comprising storing, by a user, encrypted data on a server, enabling a third-party to perform operations on the encrypted data, the operations comprising an evaluation of one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q , each of the functions taking as input one or more real-valued variables from among variables x 1 , . . . , x p , and at least one of the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q taking as input, from the encrypted data, at least two variables, the method comprising
taking as input ciphertexts of encryptions E(encode(x i ) of each of the inputs x i , with 1≤i≤p, and returning a plurality of ciphertexts of encryptions of the one or more multivariate real-valued functions ƒ 1 , . . . , ƒ q applied at their respective inputs, where E is a homomorphic encryption algorithm and encode is an encoding function which associates to each of the variables x, an element of a native space of cleartexts of E,
wherein the method further comprises:
a. a pre-calculation step comprising transforming the one of more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q into a network of real-valued univariate functions, the network comprising sums and compositions of the univariate functions,
b. a pre-selection step comprising identifying in the network of univariate functions redundancies of any one of three types:
same univariate functions applied to a same argument,
different univariate functions applied to a same argument,
same univariate functions applied to arguments differing by a non-zero additive constant,
c. a step of homomorphic evaluation of the network of univariate functions, wherein at least part of the univariate functions in the network is reused and evaluated in a shared manner according to the redundancies selected in the pre-selection step.
25. A cloud computer type remote service wherein tasks are shared between a data holder and one or more third-parties implemented as digital processing systems, the remote service comprising a hardware processor programmed to implement a homomorphic evaluation cryptographic method, the method comprising storing, by a user, encrypted data on a server, enabling a third-party to perform operations on the encrypted data, the operations comprising an evaluation of one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q , each of the functions taking as input one or more real-valued variables from among variables x 1 , . . . , x p , and at least one of the one or more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q taking as input, from the encrypted data, at least two variables, the method comprising
taking as input ciphertexts of encryptions E(encode(x i )) of each of the inputs x i , with 1≤i≤p, and returning a plurality of ciphertexts of encryptions of the one or more multivariate real-valued functions ƒ 1 , . . . , ƒ q applied at their respective inputs, where E is a homomorphic encryption algorithm and encode is an encoding function which associates to each of the variables x, an element of a native space of cleartexts of E,
wherein the method further comprises:
a. a pre-calculation step comprising transforming the one of more multivariate real-valued function(s) ƒ 1 , . . . , ƒ q into a network of real-valued univariate functions, the network comprising sums and compositions of the univariate functions,
b. a pre-selection step comprising identifying in the network of univariate functions redundancies of any one of three types:
same univariate functions applied to a same argument,
different univariate functions applied to a same argument,
same univariate functions applied to arguments differing by a non-zero additive constant,
c. a step of homomorphic evaluation of the network of univariate functions, wherein at least part of the univariate functions in the network is reused and evaluated in a shared manner according to the redundancies selected in the pre-selection step.
26. The remote service according to claim 25 involving the holder of the data x 1 , . . . , x p who wishes to keep the data secret and one or more third-parties responsible for the application of the digital processing on said data, wherein
a. the concerned third-part(y/ies) carry out, the first step of pre-calculating networks of univariate functions and the second pre-selection step
b. starting from the data x 1 , . . . , x p held by the holder of the data are calculated type data E(μ 1 ), . . . , E(μ p ), where E is a homomorphic encryption algorithm and where μ i is the encoded value of x i by an encoding function
c. once the concerned third-party has obtained the encrypted type data E(μ i ), he homomorphically evaluates in a series of successive steps based on these ciphertexts each of said networks of univariate functions, so as to obtain the ciphertexts of encryptions of ƒ j applied to their inputs (for 1≤j≤q) under the encryption algorithm
d. once he has obtained, for the considered different function(s) ƒ j the encrypted results of the encryptions on their input values, the concerned third-party sends all these results back to the holder of the data
e. the holder of the data obtains, based on the corresponding decryption key held thereby, after decoding, a value of the result of one or more function(s) (ƒ 1 , . . . , ƒ q ).
27. The remote service according to claim 26 , wherein in the second step denoted (b) in said claim, the holder of the data carries out the encryption of x 1 , . . . , x p by a homomorphic encryption algorithm E, and transmits type data E(μ 1 ), . . . , E(μ p ) to the third-party, where μ i is the encoded value of x i by an encoding function.
28. The remote service according to claim 26 , wherein in the second step denoted (b) in said claim
the holder of the data carries out the encryption of x 1 , . . . , x p by an encryption algorithm different from E and transmits said data thus encrypted,
on said received encrypted data, the concerned third-party performs a re-encryption to obtain the ciphertexts E(μ 1 ), . . . , E(μ p ) under said homomorphic encryption algorithm E, where μ i is the encoded value of x i by an encoding function.
29. The remote service according to claim 25 intended for digital processing implementing neural networks.
30. The cryptographic method according to claim 1 , wherein the encrypted data is encrypted before storing the encrypted data on the server.
31. The cryptographic method according to claim 1 , wherein the plurality of ciphertexts of encryptions of the one or more multivariate real-valued functions ƒ 1 , . . . , ƒ q are returned to the user.