Managed secure computations on encrypted data

Description of equivalent WO 2014100788 A2

MANAGED SECURE COMPUTATIONS ON ENCRYPTED DATA

BACKGROUND

0003[0001] Maintaining data confidentiality is an important concern for all computing device users regardless of task(s) performed. Encryption schemes represent one form of technology directed towards securing data when stored in memory and/or transmitted over networks. Fully homomorphic encryption (FHE) refers to an encryption scheme that allows an untrusted server to execute arbitrary computation on encrypted data on behalf of a computing device often referred to as a client.

0004[0002] Conventional solutions for constructing a FHE scheme often incur significant costs due to a reliance on certain mathematical concepts (e.g., ideal lattices) to evaluate any function on encrypted data. In practice, these constructions can be improved using conventional techniques, such as those related to batch-wise or bit-wise encryption, but often remain unworkable for a number of reasons, for example, necessitating deep circuits, such as those based on encryption standards, and/or substantial storage space to process ciphertexts. While some FHE constructions are capable of computing block ciphertexts homomorphically, evaluating a single block using these constructions are several orders of magnitude slower in terms of throughput and latency when compared to evaluating a single block non-homomorphically. Such a performance difference highlights the current impracticality of implementing FHE schemes using these conventional solutions.

SUMMARY

0006[0003] This Summary is provided to introduce a selection of representative concepts in a simplified form that are further described below in the Detailed Description. This

0007Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used in any way that would limit the scope of the claimed subject matter.

0008[0004] Briefly, various aspects of the subject matter described herein are directed towards implementing a fully homomorphic encryption scheme to evaluate an encryption standard circuit. In one aspect, a ring-based public key encryption system is fully homomorphic when constructed using well-known lattice problems and/or reduced ciphertexts in order to ensure correctness and security. In another aspect, the fully homomorphic encryption scheme encodes integers by partitioning such integers based upon an encoding parameter such that computations are performed in parallel. [0005] Based upon user input, the fully homomorphic encryption scheme is

0009automatically configured to perform such computations. In one aspect, one or more software/hardware library components select one or more parameters for configuring the encryption scheme to operate efficiently. In one aspect, restricting a cryptographic key space enables higher throughput and reduced memory usage while maintaining security and correctness. In one aspect, a computing device uses a library component to configure the fully homomorphic encryption scheme to perform the computations on the encrypted data.

0010[0006] The library component is configured to provide access to homomorphic functionality. One such function performs a mathematical operation on one or more encrypted data items. In one aspect, the library component is extended with additional homomorphic functions that are built upon other homomorphic functions. The library component is configured to process the user's input, sets bounds on computational operations and either executes such operations or issues errors if correctness cannot be assured. In one aspect, the library component informs the user when decrypted output from a homomorphic function is not equal to the result of a same computation on the input had such input been unencrypted.

0011[0007] Other advantages may become apparent from the following detailed description when taken in conjunction with the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

0013[0008] The present invention is illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which:

0014[0009] FIG. 1 is a block diagram illustrating an example system for managing secure computations on encrypted data according to one example implementation.

0015[0010] FIG. 2 is a flow diagram illustrating example steps for automatically selecting parameters that direct execution of computational operations according to one example implementation.

0016[0011] FIG. 3 is a flow diagram illustrating example steps for implementing a leveled homomorphic encryption scheme according to one example implementation.

0017[0012] FIG. 4 is a flow diagram illustrating example steps for interacting with a computation service via one or more library components according to one example implementation. [0013] FIG. 5 is a block diagram representing example non-limiting networked environments in which various embodiments described herein can be implemented.

0018[0014] FIG. 6 is a block diagram representing an example non-limiting computing system or operating environment in which one or more aspects of various embodiments described herein can be implemented.

DETAILED DESCRIPTION

0020[0015] Various aspects of the technology described herein are generally directed towards a library configured to perform computations on encrypted data over a network. Access to the library's functionality may be provided via a network resource, such as a local area network server or a cloud computing environment. The network resource may be untrusted by other computing devices herein referred to as clients. Hence, the client may use the library to prevent any adversarial computing device from deciphering the encrypted data during transmission and/or while stored in memory at the network resource. According to one example implementation, components of the library construct a fully homomorphic encrypted scheme, which may be used to privately outsource computational operations to the network resource when data is being uploaded from distributed computing devices while achieving a certain level of data correctness and security.

0021[0016] Some embodiments of the library implement a leveled fully homomorphic encryption scheme based ideal lattice problems, such as the ring learning with errors problem. One example encryption scheme may be based on the quantum hardness of short- vector problems in ideal lattices. The leveled fully homomorphic encryption scheme described herein reduces ciphertext size and eliminates ciphertext expansion in

0022homomorphic multiplication simplifying key-switching functionality. Such a scheme also may be scale invariant and therefore, negating the use of modulus switching functionality.

0023[0017] The leveled fully homomorphic encryption scheme also may reduce an overall complexity incurred in homomorphic computation by utilizing separate, small plaintext moduli that are later combined (via the Chinese remainder theorem (CRT)) into a larger plaintext modulus. Such a reduction may result in more efficient plaintext/ciphertext sizes and a lower probability of reaching a maximum amount of computation and/or the like. In one example implementation, a data item is first encoded to produce a set of encoded values and then each value is encrypted as a ciphertext. Computations performed on the data item may process each ciphertext individually, which may be facilitated by a small ciphertext size, and combine processing results into a larger ciphertext. [0018] To illustrate one example, encoding integers using a CRT-based technique described herein enhances computation precision since each integer is transformed into to more efficiently-sized (e.g., smaller) integers. The CRT -based technique also enables encoding of large integers by reducing each large integer into smaller integers that are processed separately and combined into a correct result. An Integer up to a bound B may be encoded as a set of integers of which each integer is encoded up to a bound tu

0024Computational operations may be correctly performed on the set of integers given that each modulus is co-prime and the product over all is greater than bound B. Each integer x mod in the set may be encrypted and then, processed in parallel to return encrypted results which are then decrypted/decoded to recover an original integer.

0025[0019] It should be understood that any of the examples herein are non-limiting. As such, the present invention is not limited to any particular embodiments, aspects, concepts, structures, functionalities or examples described herein. Rather, any of the embodiments, aspects, concepts, structures, functionalities or examples described herein are non-limiting, and the present invention may be used various ways that provide benefits and advantages in computing and secure computations in general.

0026[0020] FIG. 1 is a block diagram illustrating an example system for managing secure computations on encrypted data according to one example implementation. A plurality of computing devices, represented as a plurality of clients 102 in FIG. 2, utilize a network resource 104 to perform various computing tasks. Example components of the example system may further include a library front end 106, running on any example client 102, configured to interact with a library back end 108, running on the network resource 104. The library front end 106 generally refers to a set of functions (e.g., an application programming interface (API)) that communicate various data, instructions, commands and/or the like to a process configured to handle such communications for the network resource 104 as described herein.

0027[0021] The following refers to embodiments in which the network resource 104 facilitates the provision of services, such as computation services, to the example client 102. Various computing devices, including a physical machine or virtual machine herein referred to as a server, may operate within the network resource 104 and perform computations on stored data sets, such as an example data set comprising encrypted data 1 10. Example architecture for the network resource 104 decouples dedicated hardware from software such that each hardware/software component may be virtualized into units, which then may be further grouped around functionality. When performing a task, the network resource 104 may automate provisioning and configuration of some units such that each unit performs a portion of the task in parallel.

0028[0022] The network resource 104 may configure one or more components of the library back end 108 to operate in various computing environments (e.g., a local computer cluster, a private cloud computing environment, a public cloud computing environment and/or a hybrid computing environment). By encoding/encrypting the example data set and executing various computational operations on the example data set while maintaining the example data set in an encrypted state, the library back end 108 secures the example data set from unauthorized access, modification and/or misappropriation, such as by an untrusted resource .

0029[0023] As described further below, the library front end 108 provides access to an encryption mechanism 112 providing functionality with respect to a homomorphic encryption scheme 114. Such functionality enables a computation module 116 to automatically select parameter data 118 for dynamically executing secure computations on the encryption data 110.

0030[0024] Via a number of implementations of the homomorphic encryption scheme 114, one or more components of the library back end 108 evaluate a standard encryption circuit of a particular depth/level correctly and securely. At least some implementations of the homomorphic encryption scheme 114 include a leveled fully homomorphic scheme in which a user inputs a circuit depth/level (e.g., a depth-three (3)/level-four (4) circuit for

0031128-bit encryption). Instead of applying a bootstrapping procedure or one that utilizes bitwise encryption, a leveled homomorphic encryption scheme is scale invariant by limiting inherent noise growth and eliminating the modulus switching technique.

0032[0025] The library front end 108 may be used to build a private cloud computational service for outsourcing computation on the encrypted data 110. The computation module 116 may be configured to automatically establish bounds on data set size for the encrypted data. These bounds may be determined based upon user inputs including desired security level, one or more computational operations, amount and type of data to be handled and/or the like. Each computational operation may refer to a single homomorphic function or a series of such functions. An example homomorphic function may be configured to evaluate encryption circuits, such as through addition or multiplication of ciphertexts. One example implementation of the computation operation combines these functions to provide additional functionality, such as for statistical purposes, predictive modeling, machine learning and/or the like. To illustrate, the user, via the library front end 106, may instruct the library back end 108 to use the addition and/or multiplication functions to compute a mean, a standard deviation, regression values and other statistical data. The library front end 106 may be programmed to use homomorphic evaluation functions to initialize and/or train a linear classifier.

0033[0026] Configuring an instance of the homomorphic encryption scheme 114 to ensure security and correctness may rely upon computational hardness assumptions related to well known lattice problems, such as the Shortest Vector Problem (SVP). Specifically, Ring Learning With Errors (RLWE)-based implementations of the homomorphic encryption scheme 114 utilize polynomial rings, where polynomials are represented as vectors in a lattice, and truncate these polynomial rings using various techniques.

0034Example techniques include reducing a ciphertext size/space and/or a plaintext message size/space by a modulus factor, restricting a cryptographic key space to a bounded distribution, encoding polynomial ring elements using a Chinese Remainder Theorem (CRT)-based technique and so forth. A bounded cryptographic key distribution, from which polynomial ring elements representing cryptographic keys are sampled, for instance, may accomplish key space restriction. Encoding an integer data item, including a large integer, as a collection of smaller integers enables efficient computations on that integer data item.

0035[0027] Generally, the ring learning with errors (RLWE) assumption, which is related to the learning with errors (LWE) assumption, refers to preventing an adversary from distinguishing one sequence of samples from random pairs of polynomial ring elements.

0036It is appreciated that the polynomial ring elements may refer to any type of polynomial, such as a cyclotomic polynomial. By being unable to discern one polynomial from another polynomial, without substantial computing power and time, the adversary cannot reasonably decode computation results based on input polynomials. It is well-understood the RLWE assumption may be reduced to the worst case hardness of short-vector problems on ideal lattices.

0037[0028] Although the homomorphic encryption scheme 114 performs computations on elements of ring R, each element may be encoded using an encoding parameter such that an encoded vector of polynomial coefficients is identical or invertible to the original polynomial. According to one example implementation, for all polynomials that are considered to be elements of ring R, the homomorphic encryption scheme 114 reduces polynomial coefficients modulus q to produce the encoded vector. The encryption mechanism 112 may configure the homomorphic encryption scheme 1 14 to map each element in R to an integer within an integer domain of size q. Generally, such a mapping may be expressed as function r_q(a) to denote reduction of element a to interval [0, q).

0038[0029] Using the homomorphic encryption scheme 114, the encryption mechanism 112 samples cryptographic keys and/or random error polynomials from Gaussian distributions in each distribution is of a different width and may be bounded to a specific interval. A bounded Gaussian cryptographic key distribution, for instance, represents a restricted key space from which efficient cryptographic keys are generated. A set of cryptographic keys may include a public and a private key derived from a Bkey-bounded distribution; whereas, errors are deduced from a Ben-bounded distribution. Some example implementations of the homomorphic encryption scheme 114 also generate another cryptographic key referred to as an evaluation key.

0039[0030] Using the homomorphic encryption scheme 114, the library back end 108 may generate ciphertexts that only map to a single ring element in contrast to the two or more as dictated in pure ring learning with errors (RLWE) based schemes. Evaluating the homomorphic encryption scheme 114, in addition, results in little or no ciphertext expansion while executing homomorphic multiplication. The encryption mechanism 112 may rely on a decisional small polynomial ratio (DSPR) assumption to extend a basic construction of the homomorphic encryption scheme 114. For instance, by using a tensoring technique, the homomorphic encryption scheme 1 14 ensures that the public key distribution is statistically similar to a uniform distribution provided that the cryptographic key elements are sampled from Gaussian distributions of sufficient width.

0040[0031] FIG. 2 is a flow diagram illustrating example steps for automatically selecting parameters for configuring execution of computational operations according to one example implementation. One or more hardware/software components (e.g., of the library back end 108 of FIG. 1) may be configured to perform the example steps. Such components may form at least a portion of a library facilitating secure computations of encrypted data on behalf of a computing device user operating a client.

0041[0032] One example implementation includes a structural representation of a ring R, such as a polynomial ring. Let d be a positive integer and define R = Z[X]/ φά(Χ) as the ring of polynomials with integer coefficients modulo the d-th cyclotomic polynomial φά(Χ) £ Z[X]. The degree of φά is n = cp(d), where φ is Euler's totient function. The elements of R may be represented by all polynomials in Z[X] of degree less than n.

0042Elements of ring R are of arithmetic modulo φά(Χ), which is implicit whenever terms or equalities involving elements in R are described herein. [0033] A vector of coefficients may represent an arbitrary element a £ R as (ai, a₂, a₃,. .. , a_n-i) where ¾ E TL. Hence, a polynomial for a may be expressed as follows: <img file="WO2014100788A2_D0001.tif" />

0043[0034] In particular, element a can be viewed as an element of the M-vector space W. The example library component selects a maximum norm on W to measure the size of elements in R. One example implementation of the maximum norm of a may be computed as follows:

0044[0035] Let χ be a probability distribution on R according to which elements are sampled from R. Using notation a &lt;— χ to denote that a £ R is sampled, the distribution χ on R is

0045B-bounded for some B > 0 if for all elements a <— χ, an inequality ||a||∞ < B holds true.

0046[0036] By way of an example of a distribution χ on R, a discrete Gaussian distribution ϋκ,σ may be designed with a mean zero(0) and a standard deviation σ over the integer set, which assigns a probability proportional to εχρ(-π|χ|²/σ) to each element x E l When d is a power of two (2) and φά(Χ) = Xⁿ + 1 , χ may be a spherical discrete Gaussian χ = Dzⁿ,_a such that each coefficient of the polynomial is sampled according to the one-dimensional distribution Dz,₀.

0047[0037] Step 202 commences the example steps of FIG. 2 and proceeds to step 204 where one or more library components for performing computational operations on the encrypted data are provided to the client. To illustrate one example implementation, an example library component comprises instructions configured to compute a set of homomorphic functions, including linear algebra functions (e.g., vector dot product, matrix

0048multiplication and/or the like) and/or more complex mathematical functions.

0049[0038] Step 206 refers to user input processing and parameter generation with respect to executing a set of computational operations. Some user input may indicate a desired security level, a data set size, a computation precision and/or the like. Based upon such user input, the example library component selects parameters to dynamically configure execution of the set of computational operations while rendering secure and correct computation results. One example parameter includes a specific modulus, referred to as modulus q, having a variable or fixed size (e.g., 128-bit or 1024-bit) and being a power of two or, alternatively, being a Mersenne prime. Another example parameter involves setting a degree n of an evaluation polynomial φά equal to (p(d). [0039] The example library component may, alternatively, use pre-determined parameter data, such as a base field and dimension of ideal lattices. The example library component may modify the parameter data to adapt to new bounds and estimates, assuring correctness and security. Automatically selecting these and/or other parameters prevent substantial inherent noise from causing inaccurate evaluation when executing the computational operations. Step 208 determines whether a noise estimate for the set of computational operations is acceptable.

0050[0040] As described herein, the distribution χ is used in many fully homomorphic encryption schemes based upon the ring learning with errors (RLWE) problem

0051assumption, such as for sampling random error polynomials that have small coefficients with high probability. Such random error polynomials are a significant part of noise term computations used in the encryption process.

0052[0041] Because an inherent noise term of small norm allows recovery of plaintext (e.g., decrypted data) from ciphertext (e.g., encrypted data), a bound on the inherent noise in a ciphertext, assuming key and error distributions are bounded, ensures correctness in the homomorphic encryption scheme described herein.

0053[0042] To deduce meaningful bounds on inherent noise size and/or growth during homomorphic functions, the distribution χ is B-bounded for some B. For the discrete Gaussian distribution χ, this assumption is appropriate because sampled elements tend to be small in size with a high probability. Bounding enables sampling from a truncated Gaussian distribution, which is statistically close to the true discrete Gaussian χ if B is chosen large enough. For example, if the truncated distribution is bounded by B = 6σ, all samples are B-bounded with very high probability.

0054[0043] By computing at least one bound for the noise estimate, the example library component establishes a particular level of computational security and correctness. If the noise estimate fails to satisfy the at least one bound, step 208 proceeds to step 216 where the example steps depicted in FIG. 2 end. If the noise estimate complies with the inherent noise bound, step 208 proceeds to step 210. Step 210 is directed to a transformation between each computational operation and structured homomorphic functions. As an example, computing an average or mean in a set involves a series of homomorphic additions. As another example, computing a dot product between vectors of size N involves N homomorphic multiplications and N-l homomorphic additions. In yet another example, the computational operation may involve a number of vector dot products and, possibly, other homomorphic functions. [0044] Step 212 executes the structured homomorphic functions. It is appreciated that other implementations may have only one homomorphic function to execute at step 212. Nonetheless, during such execution, the example library component updates the noise estimate and/or inherent noise bound. If the noise estimate exceeds the inherent noise bound, according to one example implementation, the example library component issues errors and/or reconfiguration messages, for example, when a specific (e.g., maximum) amount of computation is reached or if a considerably large data set is entered. Upon completion of the execution of the structured homomorphic functions, the example library component performs step 214 and communicates encrypted results to the client. Step 216 terminates the example steps described herein with respect to FIG. 2.

0055[0045] FIG. 3 is a flow diagram illustrating example steps for implementing a leveled homomorphic encryption scheme according to one example implementation. As described herein, such an encryption scheme may provide a user with provably secure proofs.

0056[0046] The example steps may refer to following leveled homomorphic encryption scheme as constructed by one or more hardware/software components (e.g., of the library back end 108 of FIG.1). Such a scheme is parameterized by a modulus q and a plaintext modulus t where 1 &lt; t &lt; q. Ciphertexts produced with this scheme are elements of R = Z[X]/ φά(Χ) and plaintexts are elements of R/tR. Appropriate selections of moduli t and q and/or a cyclotomic evaluation polynomial φά(Χ) defining R facilitate data confidentiality and computational correctness.

0057[0047] Step 302 commences the example steps of FIG. 3 and proceeds to step 304 where one or more library components access a data set and generate a set of cryptographic keys based on automatically selected parameters. For instance, the modulus q may be generalized to a specific power of two (e.g., 128-bit or 1024-bit). Another example parameter involves setting a degree n of the evaluation polynomial φά equal to cp(d) based upon a user inputted security parameter.

0058[0048] Other example parameters include bounds for distributions on R. For instance, a Gaussian distribution may be Bkey bounded within a certain number of standard deviations. To demonstrate an example embodiment using Bkey = 1, even when the polynomials f ', g have coefficients in {-1, 0, 1 } and the public key h is equal to [tgf ^J]q, the public key h remains indistinguishable from a key sampled from a uniform distribution. The standard deviation of an error distribution χ_βπ on R bounded by Ben may be fixed at σ= 3 :2. The high probability bound on the size of the coefficients of errors drawn from Gaussian distributions may be selected as 6σ. [0049] The following example instructions (labeled "INSTR" below) correspond to a homomorphic function for generating a private key and a public key referred to as KeyGen(d, q, t, xk_ey, χ_βπ ):

0059INSTR(l): Sample Polynomials f', g &lt;- x_Key and let Polynomial f = tf + 1; INSTR(2): // Polynomial f E R is invertible modulo q,

0060there exists a Polynomial f^'1 such that ff^'1 = f where f(X) = ∑i a_tX^l , with a₀ = 1 mod q and a_j = 0 mod q for all j ≠ 0,

0061Else if Polynomial f is not invertible modulo q, select a new f and Repeat; INSTR(3): Compute the inverse f^'1 E R of Polynomial f modulo q and set h = [tg f- ;

0062INSTR(4): Output a Public Key and a Private Key pair (pk, sk) = (h, f) E R²;

0063[0050] Step 306 refers to encoding certain data items within the data set. A data item includes plaintext data mapping to a set of integer coefficients of a representative polynomial in R. The example library component may employ a well-known Chinese Remainder Theorem to determine a modulus q for encoding the plaintext data prior to encryption. Because the polynomial f described herein is invertible modulo q, polynomial coefficients may be reduced by an integer modulo q. Thus, a map [-]_q may reduce an integer x modulo q to a result and represents that result by an element in the interval (-q/2, q/2]. The map [-]_q may be extended to polynomials in Z[X] and R by separately applying an appropriate map entry to each coefficient as denoted by the following:

0064n-1 n-1

0065[^■]q: R→R, a = ^ → ^ [a^X¹

0066i=0 i=0

0067[0051] Similarly, the above notation may be modified for vectors of polynomials by applying mappings to vectors entries separately. One alternative implementation uses reduction integer x modulo q to represent any vector coefficient as an element in [0, q). In addition to a modulus q that is used to reduce the coefficients of the elements that represent ciphertexts, there is a second modulus t &lt; q that determines a space defined by R/tR (e.g., referred to as a message space), representing plaintext/decrypted data as polynomials in R modulo t.

0068[0052] Step 308 refers to encrypting the encoded data items using a leveled

0069homomorphic encryption scheme. The following example instructions (labeled "INSTR" below) correspond to homomorphic function referred to as Encrypt(pk, m) for encrypting a plaintext message m where a plaintext message space is defined as R/tR and refers the ring of polynomials in R modulo t:

0070INSTR(l): For a plaintext message m + tR, select [m]_t as a representative;

0071INSTR(2): Sample Polynomials s, e &lt;- x_err and Set public key h = pk = [tg

0072INSTR(3): Compute a ciphertext message c = [ L&lt;7/tJ [m]_t + e + hs] E R/qR;

0073[0053] The following equation corresponds to homomorphic function referred to as Decrypt(sk, c) for decrypting a ciphertext message c: <img file="WO2014100788A2_D0002.tif" />

0074[0054] One example embodiment of the leveled homomorphic encryption scheme described herein includes a word length w (e.g., a positive integer w > 1) used to represent integers in a radix-w system. By defining l_{q w} = [log_w(( )] where w< q, expression

0075i — 1

0076l^a] q ⁼∑_i=o [^at]w^{w t} holds for every element a in R in which each coefficient ai maps to an interval (-w/2, w/2]. The above expression clearly demonstrates that the norm of ai in the sum is at most w/2 and therefore, such an expression may be used to determine an evaluation key. Accordingly, ciphertext messages may be partitioned by word w size and after applying a homomorphic function to each portion, the leveled homomorphic encryption scheme combines each portion into a resulting ciphertext message.

0077[0055] Regarding such an embodiment, the following instructions (labeled "INSTR" below) correspond to an example function referred to as KeyGen(d,q,t,Xkey,Xerr,w) that generates a private key, a public key and an evaluation key:

0078INSTR(l): Sample Polynomials f', g &lt;- x_Key and let Polynomial f = tf + 1; INSTR(2): If Polynomial f E R is invertible modulo q,

0079there exists a Polynomial f^'1 such that ff^'1 = f where f(X) = ∑i a_tX^l , with a₀ = 1 mod q and a_j = 0 mod q for all j ≠ 0,

0080Else if Polynomial f is not invertible modulo q, select a new f and Repeat; INSTR(3): Compute the inverse f^'1 E R of Polynomial f modulo q, Set h =

0081[tg f^{~ and Se t l}q,w = ilo w(ⁱ?)l;

0082INSTR(4): Sample e, s &lt;- <img file="WO2014100788A2_D0003.tif" />

0083INSTR(5): Output Crytograhic Key triple (pk, sk, evk) = (h. f. y) E R²

0084[0056] An alternative to the above implementations includes a leveled fully

0085homomorphic encryption scheme that is provably secure under the assumed quantum hhaarrddnneessss ooff ssttaannddaarrdd wwoorrsstt--ccaassee llaattttiiccee pprroobblleemmss.. TThhee ffoolllloowwiinngg ddeessccrriippttiioonn rreeffeerrss ttoo rriinngg-- bbaasseedd eennccrryyppttiioonn ssyysstteemmss bbaasseedd oonn tthhee RRLLWWEE aassssuummppttiioonn aanndd aa cciirrccuullaarr sseeccuurriittyy aassssuummppttiioonn ggiivveenn tthhee DDSSPPRR aassssuummppttiioonn iiss ssaattiissffiieedd ffoorr tthhiiss sseettttiinngg ooff ppaarraammeetteerrss.. TThhee ppoollyynnoommiiaall rriinngg RR iiss ggiivveenn bbyy RR == ZZ[[xx]] == XXⁿⁿ ++ 11 wwhheerree nn iiss aa ppoowweerr ooff 22 aanndd dd == 22nn.. FFuurrtthheerrmmoorree,, ggccdd((qq>>,, tt)) == 11 aanndd qq ≡≡ ((mmoodd dd)) ssuucchh tthhaatt XXⁿⁿ ++ 11 sspplliittss iinnttoo ddiissttiinncctt lliinneeaarr ffaaccttoorrss mmoodduulloo qq.. PPrroovviinngg tthhee DDSSPPRR aassssuummppttiioonn hhoollddss rreeqquuiirreess gguuaarraanntteeeeiinngg ppuubblliicc kkeeyy uunniiffoorrmmiittyy iinn aaccccoorrddaannccee wwiitthh aannyy rreelleevvaanntt tteecchhnniiqquuee.. TThhee ssttaannddaarrdd ddeevviiaattiioonn ooff tthhee GGaauussssiiaann ddiissttrriibbuuttiioonn XXkkeeyy nneeeeddss ttoo bbee llaarrggeerr tthhaann VVqq,, wwhhiicchh mmaakkeess tthhee bboouunndd BBkkeeyy llaarrggeerr tthhaann VVqq.. HHeennccee,, tthhee bboouunndd ffoorr tthhee iinnhheerreenntt nnooiissee iinn aann iinniittiiaall cciipphheerrtteexxtt VVqq.. AAfftteerr eexxeeccuuttiinngg oonnee hhoommoommoorrpphhiicc mmuullttiipplliiccaattiioonn ffuunnccttiioonn,, aa tteennssoorriinngg mmeetthhoodd mmaayy pprreevveenntt tthhee oovveerraallll iinnhheerreenntt nnooiissee bboouunndd ffrroomm eexxcceeeeddiinngg aa tthhrreesshhoolldd..

0086[[00005577]] GGiivveenn aa sseeccuurriittyy ppaarraammeetteerr aass uusseerr iinnppuutt,, tthhee eexxaammppllee lliibbrraarryy ccoommppoonneenntt oouuttppuuttss aa ddaattaa pprreecciissiioonn sseettttiinngg mmoodduulluuss qq,, aa wwoorrdd ssiizzee ww,, aa rraannddoomm eerrrroorr ppoollyynnoommiiaall ddiissttrriibbuuttiioonn,, aa ccrryyppttooggrraapphhiicc kkeeyy ddiissttrriibbuuttiioonn,, aa ddeeggrreeee nn ooff tthhee eevvaalluuaattiioonn ppoollyynnoommiiaall φφάά eeqquuaall ttoo ccpp((dd)) aanndd//oorr tthhee lliikkee wwhheerree dd == 22nn iiss tthhee ppoowweerr ooff 22 tthhaatt ddeetteerrmmiinneess φ 4>_αd ((XX)) == XXⁿⁿ ++ 11 ttoo ddeeffiinnee RR,, qq >> tt aarree mmoodduullii.. xx_eerrrr == wwiitthh ssttaannddaarrdd ddeevviiaattiioonnss CCeenn aanndd <img file="WO2014100788A2_D0004.tif" />

0087cakkeeyy,, rreessppeeccttiivveellyy,, aarree ddiissccrreettee GGaauussssiiaann ddiissttrriibbuuttiioonnss oonn ΈΈ^ηη tthhaatt ssaammppllee iinnvveerrttiibbllee eelleemmeennttss bbyy ddiissccaarrddiinngg nnoonn--iinnvveerrttiibbllee oonneess.. UUnnddeerr ssuucchh aa ccoonnffiigguurraattiioonn,, tthhee eexxaammppllee lliibbrraarryy ccoommppoonneenntt ssaammpplleess ee,, ss &lt;&lt;-- <img file="WO2014100788A2_D0005.tif" />

0088h ^■ s \ E R ^^w, and outputs a triple comprising a public key (pk), a private key (sk) and an evaluation key (evk) equal to polynomials (h, f, γ).

0089[0058] Step 310 represents basic homographic function production. The example library component uses parameter data to complete configuration of various homographic function specifications. One example homomorphic function refers to an Add(ci,c₂) function defined to compute an addition of input ciphertexts cl ,c2 with the following equation:

0090<img file="WO2014100788A2_D0006.tif" />

0091[0059] Another example homomorphic function includes a Mult (ci,c₂) function that computes a multiplication of input ciphertexts ci,c₂ using an evaluation key evk with the following equation:

0092t

0093mult = KeySwitch ( , evk) [0060] As another example homomorphic function, a KeySwitch function transforms the ciphertext c_muit encrypting the product [mim₂]t of plaintext ml and m2, which is recoverable using the evaluation key evk, into a ciphertext Cmuit that is capable of being decrypted with the original private key pk. Alternatively, the example library component employs a known key- switching function to build homomorphic multiplication functions.

0094[0061] The example library component may utilize other software/hardware components to perform a modulus reduction where polynomial coefficients are scaled down by a factor, such as a reduction by modulo q. The modulus reduction homomorphic function may be applied to any set of polynomial coefficients in ring R, including plaintext (e.g., decrypted) data and/or ciphertext (e.g., decrypted) data. Accordingly, an original set of coefficients and an encoded set of coefficients are congruent to each other modulo q where q may be equal to two (2), a power of 2, a prime number and or the like). Such a function may be employed to encode the plaintext data prior to encryption, which limits ciphertext size, reduces inherent noise (e.g., magnitude), improve computation latency and/or provide additional benefits. Regarding example implementations that involve encoding data, as described with respect to step 306, a congruency between an original plaintext (message m) and an encoded plaintext (encoded message m') may be expressed via the following equation:

0095m'≡ m (mod q)

0096[0062] Step 312 is directed to building other homographic functions. The example library component may utilize software/hardware components to perform a linear algebra function. One example homomorphic function performs a dot product operation of the plaintext message comprising a set of vector coefficients in R with another set of vector coefficients in R. In one example implementation, the example library component builds upon instances of such a dot product homomorphic function to provide homomorphic matrix multiplication functionality where each matrix entry comprises a set of vector coefficients in R. Similar to the Mult() and Encrypt() functions, a noise estimate homomorphic function may estimate an inherent noise magnitude and project the influence such noise on the security or correctness future computations.

0097[0063] Yet another example homomorphic function computes a noise estimate indicating the noise magnitude when encrypting the plaintext into the ciphertext. This function may couple the noise estimate to the ciphertext with the ring R. Optionally, this function computes a noise estimate associated with an execution of any other

0098homomorphic function, including any of the functions described herein, such as Add() or Mult(), or other homomorphic functions, such as those corresponding to implementing other encryption schemes.

0099[0064] Using the notation described herein, inherent noise terms may be modeled when estimating noise increases for any homomorphic function. The following description includes details on determining bounds for such noise terms when word length is set to w and l_{q w} = [log_w(( )l and vi in R denotes an example inherent noise term in Ci. Hence, assuming Cadd stores results from executing function Add(ci,c₂), a corresponding noise term v_add is bounded according to expression || v_add | |_∞ &lt; HfJI oo + 11 ^2 II∞ + ^(o - If Cmuit refers to an encrypted product of two ciphertexts, the proceeding inequality bounds a corresponding noise term v_muit : l l ^muZt l l oo ≤ 77 δ (t(2 + StflfceyXl H oo + Ha ll oo) + (1 + r_t(q)) min| | i7₂ | |_∞)

0100+ + (StB_keyf + (r_t(q)5t(3 + tB_key†j + 5²tl_q>wwB_keyB_err

0101[0065] The noise terms described above are directed towards homomorphic addition and multiplication, but such terms may be interpolated when deducing bounds for

0102computational operations involving other homomorphic functions. The obtained bounds can then be used to deduce suitable parameters for automatically configuring future computations for correctness and security using the leveled fully homomorphic encryption scheme described herein.

0103[0066] According to one example implementation in which a leveled tree structure of multiplication functions represents a set of computational operations, ciphertexts at each level are assumed to have inherent noise terms substantially equal in magnitude. Such an assumption may approximate unbalanced inherent noise terms, which results in accurate noise bound estimates.

0104[0067] Hence, the example library component may build a structure comprising a series of Mult() functions that are executed iteratively. A homomorphic rounding function may involve a considerable number of consecutive multiplications. The leveled homomorphic scheme may utilize scaling by rational numbers such that the resulting polynomials have rational coefficients instead of integer coefficients. When applied, the rounding function reverts the rational coefficients back into the corresponding integer coefficients.

0105Additional example homographic functions include encryption standard-based functions, such AES functions (e.g., AddKey, SubBytes, ShiftRows, MixColumns and/or the like) and/or the like. [0068] Step 314 refers to providing a plurality of clients (e.g., computing devices) with access to the homographic functions. Via the example library component, any client may interact with and use embodiments of the other homomorphic functions through hardware mechanisms (e.g., microprocessor instruction sets) and/or software mechanisms (e.g., driver-based software libraries). Step 316 terminates the example steps of FIG. 3.

0106[0069] FIG. 4 is a flow diagram illustrating example steps for interacting with a computation service via one or more library components according to one example implementation. The computation service provides access to certain software/hardware- based functionality available on a network resource (e.g., a private cloud computing resource). A user operating a computing device, referred to herein as a client, may use the computation service to automatically configure a leveled fully homomorphic encryption scheme to effectuate these secure computations.

0107[0070] As described herein, an example library component (e.g., a library front end 106 of FIG. 1) may be configured to perform at least some of the example steps by initiating secure computations on encrypted data and/or analyzing any results from such

0108computations. Step 302 commences the example steps and proceeds to step 304 where a security parameter is established. As noted in the present disclosure, the security parameter defines certain desired settings, including a depth level for a standardized encryption circuit. The user, for instance, may request 128-bit fully homomorphic encryption on an AES circuit of depth level N (e.g., 3). By entering the security parameter as input into the computational service, the user may indicate a level of correctness, for example, in terms of precision, and/or security, for example, in terms of

0109indistinguishability to an adversary. The computation service returns a set of additional parameters for configuring the leveled fully homomorphic encryption scheme in a manner that substantially satisfies the security parameter.

0110[0071] Step 406 refers to using the computation service to encrypt data items of a data set. As described herein, using principals founded in the Chinese Remainder Theorem (CRT), the example library component may instruct the computation service to encode each encrypted data item such that the adversary cannot distinguish between that data item and another random data item.

0111[0072] Step 408 selects a computational operation for the computation service to perform. Accordingly, step 408 proceeds to issue a command via step 410, step 412 and/or step 414. If the computation operation refers to a homomorphic addition function, step 408 proceeds to step 410. If the command is directed towards a homomorphic multiplication function, step 408 proceeds to step 412. If the user desires results from another homomorphic function, step 408 proceeds to step 414. Although some computation operations may include a single homomorphic function, other computational operations involve executing structured homomorphic functions in which an arrangement of function calls perform any type of mathematical computation. For instance, a series of function calls may be configured to train a linear classifier.

0112[0073] Step 416 determines whether to process computation results or perform another computational operation. Step 416 returns to step 408 if, for example, the client is running a process engaged in a continuous computations, such as an online machine learning application. Step 416 proceeds to step 418, however, when the computation results are to be analyzed. Because both the encrypted and the computation results remain in an encrypted state throughout the computational operation, the encryption scheme prevents an untrusted resource from deciphering the encrypted data during transmission and/or storage. An adversary on an untrusted host server or otherwise connected to the client, for instance, cannot distinguish between two additions of random data item pairs. Step 418 refers to the example library component using the computation service to decrypt the encrypted computation results. Step 420 terminates the example steps depicted in FIG. 4.

EXAMPLE NETWORKED AND DISTRIBUTED ENVIRONMENTS

0114[0074] One of ordinary skill in the art can appreciate that the various embodiments and methods described herein can be implemented in connection with any computer or other client or server device, which can be deployed as part of a computer network or in a distributed computing environment, and can be connected to any kind of data store or stores. In this regard, the various embodiments described herein can be implemented in any computer system or environment having any number of memory or storage units, and any number of applications and processes occurring across any number of storage units. This includes, but is not limited to, an environment with server computers and client computers deployed in a network environment or a distributed computing environment, having remote or local storage.

0115[0075] Distributed computing provides sharing of computer resources and services by communicative exchange among computing devices and systems. These resources and services include the exchange of information, cache storage and disk storage for objects, such as files. These resources and services also include the sharing of processing power across multiple processing units for load balancing, expansion of resources, specialization of processing, and the like. Distributed computing takes advantage of network connectivity, allowing clients to leverage their collective power to benefit the entire enterprise. In this regard, a variety of devices may have applications, objects or resources that may participate in the resource management mechanisms as described for various embodiments of the subject disclosure.

0116[0076] FIG. 5 provides a schematic diagram of an example networked or distributed computing environment. The distributed computing environment comprises computing objects 510, 512, etc., and computing objects or devices 520, 522, 524, 526, 528, etc., which may include programs, methods, data stores, programmable logic, etc. as represented by example applications 530, 532, 534, 536, 538. It can be appreciated that computing objects 510, 512, etc. and computing objects or devices 520, 522, 524, 526, 528, etc. may comprise different devices, such as personal digital assistants (PDAs), audio/video devices, mobile phones, MP3 players, personal computers, laptops, etc.

0117[0077] Each computing object 510, 512, etc. and computing objects or devices 520, 522, 524, 526, 528, etc. can communicate with one or more other computing objects 510, 512, etc. and computing objects or devices 520, 522, 524, 526, 528, etc. by way of the communications network 540, either directly or indirectly. Even though illustrated as a single element in FIG. 5, communications network 540 may comprise other computing objects and computing devices that provide services to the system of FIG. 5, and/or may represent multiple interconnected networks, which are not shown. Each computing object 510, 512, etc. or computing object or device 520, 522, 524, 526, 528, etc. can also contain an application, such as applications 530, 532, 534, 536, 538, that might make use of an API, or other object, software, firmware and/or hardware, suitable for communication with or implementation of the application provided in accordance with various embodiments of the subject disclosure.

0118[0078] There are a variety of systems, components, and network configurations that support distributed computing environments. For example, computing systems can be connected together by wired or wireless systems, by local networks or widely distributed networks. Currently, many networks are coupled to the Internet, which provides an infrastructure for widely distributed computing and encompasses many different networks, though any network infrastructure can be used for example communications made incident to the systems as described in various embodiments.

0119[0079] Thus, a host of network topologies and network infrastructures, such as client/server, peer-to-peer, or hybrid architectures, can be utilized. The "client" is a member of a class or group that uses the services of another class or group to which it is not related. A client can be a process, e.g., roughly a set of instructions or tasks, that requests a service provided by another program or process. The client process utilizes the requested service without having to "know" any working details about the other program or the service itself.

0120[0080] In a client / server architecture, particularly a networked system, a client is usually a computer that accesses shared network resources provided by another computer, e.g., a server. In the illustration of FIG. 5, as a non-limiting example, computing objects or devices 520, 522, 524, 526, 528, etc. can be thought of as clients and computing objects 510, 512, etc. can be thought of as servers where computing objects 510, 512, etc., acting as servers provide data services, such as receiving data from client computing objects or devices 520, 522, 524, 526, 528, etc., storing of data, processing of data, transmitting data to client computing objects or devices 520, 522, 524, 526, 528, etc., although any computer can be considered a client, a server, or both, depending on the circumstances.

0121[0081] A server is typically a remote computer system accessible over a remote or local network, such as the Internet or wireless network infrastructures. The client process may be active in a first computer system, and the server process may be active in a second computer system, communicating with one another over a communications medium, thus providing distributed functionality and allowing multiple clients to take advantage of the information-gathering capabilities of the server.

0122[0082] In a network environment in which the communications network 540 or bus is the Internet, for example, the computing objects 510, 512, etc. can be Web servers with which other computing objects or devices 520, 522, 524, 526, 528, etc. communicate via any of a number of known protocols, such as the hypertext transfer protocol (HTTP). Computing objects 510, 512, etc. acting as servers may also serve as clients, e.g., computing objects or devices 520, 522, 524, 526, 528, etc., as may be characteristic of a distributed computing environment.

EXAMPLE COMPUTING DEVICE

0124[0083] As mentioned, advantageously, the techniques described herein can be applied to any device. It can be understood, therefore, that handheld, portable and other computing devices and computing objects of all kinds are contemplated for use in connection with the various embodiments. Accordingly, the below general purpose remote computer described below in FIG. 6 is but one example of a computing device.

0125[0084] Embodiments can partly be implemented via an operating system, for use by a developer of services for a device or object, and/or included within application software that operates to perform one or more functional aspects of the various embodiments described herein. Software may be described in the general context of computer executable instructions, such as program modules, being executed by one or more computers, such as client workstations, servers or other devices. Those skilled in the art will appreciate that computer systems have a variety of configurations and protocols that can be used to communicate data, and thus, no particular configuration or protocol is considered limiting.

0126[0085] FIG. 6 thus illustrates an example of a suitable computing system environment 600 in which one or aspects of the embodiments described herein can be implemented, although as made clear above, the computing system environment 600 is only one example of a suitable computing environment and is not intended to suggest any limitation as to scope of use or functionality. In addition, the computing system environment 600 is not intended to be interpreted as having any dependency relating to any one or

0127combination of components illustrated in the example computing system environment 600.

0128[0086] With reference to FIG. 6, an example remote device for implementing one or more embodiments includes a general purpose computing device in the form of a computer 610. Components of computer 610 may include, but are not limited to, a processing unit 620, a system memory 630, and a system bus 622 that couples various system components including the system memory to the processing unit 620.

0129[0087] Computer 610 typically includes a variety of computer readable media and can be any available media that can be accessed by computer 610. The system memory 630 may include computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) and/or random access memory (RAM). By way of example, and not limitation, system memory 630 may also include an operating system, application programs, other program modules, and program data.

0130[0088] A user can enter commands and information into the computer 610 through input devices 640. A monitor or other type of display device is also connected to the system bus 622 via an interface, such as output interface 650. In addition to a monitor, computers can also include other peripheral output devices such as speakers and a printer, which may be connected through output interface 650.

0131[0089] The computer 610 may operate in a networked or distributed environment using logical connections to one or more other remote computers, such as remote computer 670. The remote computer 670 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, or any other remote media consumption or transmission device, and may include any or all of the elements described above relative to the computer 610. The logical connections depicted in Fig. 6 include a network 672, such local area network (LAN) or a wide area network (WAN), but may also include other networks/buses. Such networking environments are commonplace in homes, offices, enterprise-wide computer networks, intranets and the Internet.

0132[0090] As mentioned above, while example embodiments have been described in connection with various computing devices and network architectures, the underlying concepts may be applied to any network system and any computing device or system in which it is desirable to improve efficiency of resource usage.

0133[0091] Also, there are multiple ways to implement the same or similar functionality, e.g., an appropriate API, tool kit, driver code, operating system, control, standalone or downloadable software object, etc. which enables applications and services to take advantage of the techniques provided herein. Thus, embodiments herein are contemplated from the standpoint of an API (or other software object), as well as from a software or hardware object that implements one or more embodiments as described herein. Thus, various embodiments described herein can have aspects that are wholly in hardware, partly in hardware and partly in software, as well as in software.

0134[0092] The word "exemplary" is used herein to mean serving as an example, instance, or illustration. For the avoidance of doubt, the subject matter disclosed herein is not limited by such examples. In addition, any aspect or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects or designs, nor is it meant to preclude equivalent exemplary structures and techniques known to those of ordinary skill in the art. Furthermore, to the extent that the terms "includes," "has," "contains," and other similar words are used, for the avoidance of doubt, such terms are intended to be inclusive in a manner similar to the term "comprising" as an open transition word without precluding any additional or other elements when employed in a claim.

0135[0093] As mentioned, the various techniques described herein may be implemented in connection with hardware or software or, where appropriate, with a combination of both. As used herein, the terms "component," "module," "system" and the like are likewise intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on computer and the computer can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers.

0136[0094] The aforementioned systems have been described with respect to interaction between several components. It can be appreciated that such systems and components can include those components or specified sub-components, some of the specified components or sub-components, and/or additional components, and according to various permutations and combinations of the foregoing. Sub-components can also be implemented as components communicatively coupled to other components rather than included within parent components (hierarchical). Additionally, it can be noted that one or more components may be combined into a single component providing aggregate functionality or divided into several separate sub-components, and that any one or more middle layers, such as a management layer, may be provided to communicatively couple to such subcomponents in order to provide integrated functionality. Any components described herein may also interact with one or more other components not specifically described herein but generally known by those of skill in the art.

0137[0095] In view of the example systems described herein, methodologies that may be implemented in accordance with the described subject matter can also be appreciated with reference to the flowcharts of the various figures. While for purposes of simplicity of explanation, the methodologies are shown and described as a series of blocks, it is to be understood and appreciated that the various embodiments are not limited by the order of the blocks, as some blocks may occur in different orders and/or concurrently with other blocks from what is depicted and described herein. Where non-sequential, or branched, flow is illustrated via flowchart, it can be appreciated that various other branches, flow paths, and orders of the blocks, may be implemented which achieve the same or a similar result. Moreover, some illustrated blocks are optional in implementing the methodologies described hereinafter.

CONCLUSION

0139[0096] While the invention is susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the invention to the specific forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of the invention. [0097] In addition to the various embodiments described herein, it is to be understood that other similar embodiments can be used or modifications and additions can be made to the described embodiment(s) for performing the same or equivalent function of the corresponding embodiment(s) without deviating therefrom. Still further, multiple processing chips or multiple devices can share the performance of one or more functions described herein, and similarly, storage can be effected across a plurality of devices. Accordingly, the invention is not to be limited to any single embodiment, but rather is to be construed in breadth, spirit and scope in accordance with the appended claims.