Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018)...
Transcript of Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018)...
![Page 1: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/1.jpg)
Approximate HomomorphicEncryptionMOTIVATION, CONSTRUCTION, APPLICATIONS
YONGSOO SONG
UCSD
![Page 2: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/2.jpg)
What is the Next Goal?“HE system can evaluate an arbitrary circuit in a polynomial time.”
![Page 3: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/3.jpg)
What is the Next Goal?“HE system can evaluate an arbitrary circuit in a polynomial time.”
Cryptography community has improved the Efficiency of HE system.§ Performance: Speed, Storage, Expansion rate, etc.§ Functionality: Key-switching, Rotation, Plaintext Space, etc.
![Page 4: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/4.jpg)
What is the Next Goal?“HE system can evaluate an arbitrary circuit in a polynomial time.”
Cryptography community has improved the Efficiency of HE system.§ Performance: Speed, Storage, Expansion rate, etc.§ Functionality: Key-switching, Rotation, Plaintext Space, etc.
Reduction of “Gap” between Real and Encrypted computations.
Datatypes and operations§ Boolean Circuit (Bit Operation)§ Integer Operations§ Modular Arithmetic§ Approximate Arithmetic (Fixed/Floating-point Operation)§ Logical Operations (If & Else statement)
![Page 5: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/5.jpg)
Homomorphic Encryption SchemesScheme Plaintext
Slot Good Bad Library
“Word Encryption”Brakerski-Gentry-Vaikuntanathan’12Gentry-Halevi-Smart’12a,b,cBrakerski’12, Fan-Vercauteren’12Halevi-Shoup’13,14,15
GF(pd) (Zp)Polylog overhead(Amortized time
& Expansion rate)Bootstrapping
HElibSEAL
…
Gentry-Sahai-Waters’13
“Bitwise Encryption”Ducas-Micciancio’15Chillotti-Gama-Georgieva-Izabachene’16,17
![Page 6: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/6.jpg)
Homomorphic Encryption SchemesScheme Plaintext
Slot Good Bad Library
“Word Encryption”Brakerski-Gentry-Vaikuntanathan’12Gentry-Halevi-Smart’12a,b,cBrakerski’12, Fan-Vercauteren’12Halevi-Shoup’13,14,15
GF(pd) (Zp)Polylog overhead(Amortized time
& Expansion rate)Bootstrapping
HElibSEAL
…
Gentry-Sahai-Waters’13 Z, Z[X] ({0,1}) Beauty J Inefficient
“Bitwise Encryption”Ducas-Micciancio’15Chillotti-Gama-Georgieva-Izabachene’16,17
![Page 7: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/7.jpg)
Homomorphic Encryption SchemesScheme Plaintext
Slot Good Bad Library
“Word Encryption”Brakerski-Gentry-Vaikuntanathan’12Gentry-Halevi-Smart’12a,b,cBrakerski’12, Fan-Vercauteren’12Halevi-Shoup’13,14,15
GF(pd) (Zp)Polylog overhead(Amortized time
& Expansion rate)Bootstrapping
HElibSEAL
…
Gentry-Sahai-Waters’13 Z, Z[X] ({0,1})Beauty J
Toolkit for FHEWInefficient
“Bitwise Encryption”Ducas-Micciancio’15Chillotti-Gama-Georgieva-Izabachene’16,17
{0,1}, ({0,1}*)Evaluation withBootstrapping.
Latency.
Amortized time& Expansion rate
FHEWTFHE
![Page 8: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/8.jpg)
Application Researches of HE (2017~2018)“Homomorphic Encryption” in ePrint and IEEE Xplore
![Page 9: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/9.jpg)
Application Researches of HE (2017~2018)“Homomorphic Encryption” in ePrint and IEEE Xplore
◦ Machine Learning: 11 (2018/233,202,139,074, 2017/979,715.
SSCI, IEEE Access, IEEE Journal, ICCV, SMARTCOMP)
◦ Neural Network: 2 (2018/073, 2017/1114)
◦ Genomic Data: 7 (2017/955,770,294,228. EUSIPCO, SMARTCOMP, IEEE Journal)
◦ Health Data: 2 (IBM Journal, IEEE Journal)
◦ Biometric Data: 2 (IEEE Access, IEEE Conference)
◦ Energy Management: 3 (2017/1212. IEEE Big Data, IET Journal)
◦ Big Data: 1 (ICBDA)
◦ Advertising: 1 (WIFS)
◦ Internet of Things: 1 (IWCMC)
◦ Election: 1 (2017/166)
![Page 10: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/10.jpg)
Application Researches of HE (2017~2018)“Homomorphic Encryption” in ePrint and IEEE Xplore
◦ Machine Learning: 11 (2018/233,202,139,074, 2017/979,715.
SSCI, IEEE Access, IEEE Journal, ICCV, SMARTCOMP)
◦ Neural Network: 2 (2018/073, 2017/1114)
◦ Genomic Data: 7 (2017/955,770,294,228. EUSIPCO, SMARTCOMP, IEEE Journal)
◦ Health Data: 2 (IBM Journal, IEEE Journal)
◦ Biometric Data: 2 (IEEE Access, IEEE Conference)
◦ Energy Management: 3 (2017/1212. IEEE Big Data, IET Journal)
◦ Big Data: 1 (ICBDA)
◦ Advertising: 1 (WIFS)
◦ Internet of Things: 1 (IWCMC)
◦ Election: 1 (2017/166)
![Page 11: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/11.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
![Page 12: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/12.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
Word Encryption§ Represent a real number as an integer.§ No Rounding operation is very expensive.
![Page 13: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/13.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
Word Encryption§ Represent a real number as an integer.
§ No Rounding operation is very expensive.
§ Bit size of message grows exponentially.
1,234 * 689 * 2,194 * 917 * 3,323 * 4,154 * 489 * 3,772 = 4,355,296,408,921,213,975,719,328 > 285.
![Page 14: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/14.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
Word Encryption§ Represent a real number as an integer.
§ No Rounding operation is very expensive.
§ Bit size of message grows exponentially.
1,234 * 689 * 2,194 * 917 * 3,323 * 4,154 * 489 * 3,772 = 4,355,296,408,921,213,975,719,328 > 285.
Base Encoding [DGL+’15, CSCW’16, CLPX’17 (High-precision HE)]§ Express a real number as a (small) polynomial. e.g. (1.234) → (1 + 2X-1 + 3X-2 + 4X-3)
![Page 15: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/15.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
Word Encryption§ Represent a real number as an integer.
§ No Rounding operation is very expensive.
§ Bit size of message grows exponentially.
1,234 * 689 * 2,194 * 917 * 3,323 * 4,154 * 489 * 3,772 = 4,355,296,408,921,213,975,719,328 > 285.
Base Encoding [DGL+’15, CSCW’16, CLPX’17 (High-precision HE)]§ Express a real number as a (small) polynomial. e.g. (1.234) → (1 + 2X-1 + 3X-2 + 4X-3)
§ Exponential growth of Degree
§ Trade-off between Precision & Number of slots
§ No Bootstrapping
![Page 16: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/16.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
Bitwise Encryption§ 0.06 sec for (2-to-1) gate.§ 10 sec for (6-to-6) circuit.
![Page 17: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/17.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
Bitwise Encryption§ 0.06 sec for (2-to-1) gate.§ 10 sec for (6-to-6) circuit.
75 Gates for an operation ontwo four-bit strings.
How many gates for16-bit / 32-bit precision multiplication?
![Page 18: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/18.jpg)
Homomorphic Encryption SchemesScheme Plaintext
Slot Good Bad Library
“Word Encryption”Brakerski-Gentry-Vaikuntanathan’12Gentry-Halevi-Smart’12a,b,cBrakerski’12, Fan-Vercauteren’12Halevi-Shoup’13,14,15
GF(pd) (Zp)Polylog overhead(Amortized time
& Expansion rate)Bootstrapping
HElibSEAL
…
Gentry-Sahai-Waters’13 Z, Z[X] ({0,1})Beauty J
Toolkit for FHEWInefficient
“Bitwise Encryption”Ducas-Micciancio’15Chillotti-Gama-Georgieva-Izabachene’16,17
{0,1}, ({0,1}k)Evaluation withBootstrapping.
Latency.
Amortized time& Expansion rate
FHEWTFHE
![Page 19: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/19.jpg)
Homomorphic Encryption SchemesScheme Plaintext
Slot Good Bad Library
“Word Encryption”Brakerski-Gentry-Vaikuntanathan’12Gentry-Halevi-Smart’12a,b,cBrakerski’12, Fan-Vercauteren’12Halevi-Shoup’13,14,15
GF(pd) (Zp)Polylog overhead(Amortized time
& Expansion rate)Bootstrapping
HElibSEAL
…
Gentry-Sahai-Waters’13 Z, Z[X] ({0,1})Beauty J
Toolkit for FHEWInefficient
“Bitwise Encryption”Ducas-Micciancio’15Chillotti-Gama-Georgieva-Izabachene’16,17
{0,1}, ({0,1}k)Evaluation withBootstrapping.
Latency.
Amortized time& Expansion rate
FHEWTFHE
“Approximate Encryption”Cheon-Kim-Kim-Song’17Cheon-Han-Kim-Kim-Song’18
Complex (Real)Numbers
Fixed-point Arithmetic.
Polylog overhead.
HEAAN(慧眼)
![Page 20: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/20.jpg)
Approximate Homomorphic EncryptionMotivation: Imitate the approximate arithmetic on computer system.
1.234 * 0.689 = (1,234 * 10-3) * (689 * 10-3)
![Page 21: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/21.jpg)
Approximate Homomorphic EncryptionMotivation: Imitate the approximate arithmetic on computer system.
1.234 * 0.689 = (1,234 * 10-3) * (689 * 10-3) = 850,226 * 10-6 = 850 * 10-3
![Page 22: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/22.jpg)
Approximate Homomorphic EncryptionMotivation: Imitate the approximate arithmetic on computer system.
1.234 * 0.689 = (1,234 * 10-3) * (689 * 10-3) = 850,226 * 10-6 = 850 * 10-3
Idea 1. Every number contains an Approximation Error (between unknown true value).
Consider an RLWE error as part of it.
![Page 23: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/23.jpg)
Approximate Homomorphic EncryptionMotivation: Imitate the approximate arithmetic on computer system.
1.234 * 0.689 = (1,234 * 10-3) * (689 * 10-3) = 850,226 * 10-6 = 850 * 10-3
Idea 1. Every number contains an Approximation Error (between unknown true value).
Consider an RLWE error as part of it.
ct = Enc (m) if [<ct,sk>]q = m+e ≈ m.
![Page 24: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/24.jpg)
Approximate Homomorphic EncryptionMotivation: Imitate the approximate arithmetic on computer system.
1.234 * 0.689 = (1,234 * 10-3) * (689 * 10-3) = 850,226 * 10-6 = 850 * 10-3
Idea 1. Every number contains an Approximation Error (between unknown true value).
Consider an RLWE error as part of it.
ct = Enc (m) if [<ct,sk>]q = m+e ≈ m.
Approximate HE: (1.234) ⇒ (scale by p=104) ⇒ 12,340.
⇒ (Encrypt) ⇒ [<ct,sk>]q = 12,342 ≈ 1.234 * 104.
![Page 25: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/25.jpg)
Approximate Homomorphic EncryptionMotivation: Imitate the approximate arithmetic on computer system.
1.234 * 0.689 = (1,234 * 10-3) * (689 * 10-3) = 850,226 * 10-6 = 850 * 10-3
Idea 2. Approximate Rounding is easy!
<ct, sk> = m (mod q)
ct ↦ ct’ =「p-1 * ct 」
<ct’, sk> (mod p-1 q) ≈ p-1 m
![Page 26: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/26.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
1.234
0.689
2.194
0.917
3.323
4.154
0.489
3.772
![Page 27: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/27.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
1.234
0.689
2.194
0.917
3.323
4.154
0.489
3.772
12,340
6,890
21,940
9,170
33,230
41,540
4,890
37,720
12,337
6,893
21,941
9,175
33,225
41,543
4,892
37,718
Scaling Encrypt
![Page 28: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/28.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
1.234
0.689
2.194
0.917
3.323
4.154
0.489
3.772
12,340
6,890
21,940
9,170
33,230
41,540
4,890
37,720
85,038,943
201,308,673
1,380,266,171
184,516,459
12,337
6,893
21,941
9,175
33,225
41,543
4,892
37,718
8,499
20,125
138,021
18,451
Scaling Encrypt HomMult HomRnd
![Page 29: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/29.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
8,499
20,125
138,021
18,451
![Page 30: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/30.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
171,042,375
2,546,625,471
8,499
20,125
138,021
18,451
HomMult HomRnd
17,103
254,664
![Page 31: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/31.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = ?
171,042,375
2,546,625,471
8,499
20,125
138,021
18,451
HomMult HomRnd
17,103
254,664 HomMult
4,355,518,392
HomRnd
435,552
![Page 32: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/32.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = 43.555
171,042,375
2,546,625,471
8,499
20,125
138,021
18,451
HomMult HomRnd
17,103
254,664 HomMult
4,355,518,392
HomRnd
435,552
Decrypt
435,552
Scaling
Res = 43.555
![Page 33: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/33.jpg)
How to perform Approximate Arithmetic on HE?1.234 * 0.689 * 2.194 * 0.917 * 3.323 * 4.154 * 0.489 * 3.772 = 43.555
171,042,375
2,546,625,471
8,499
20,125
138,021
18,451
HomMult HomRnd
17,103
254,664 HomMult
4,355,518,392
HomRnd
435,552
Decrypt
435,552
Scaling
Res = 43.555
Linear Bit size of Ciphertext Modulus: log q = O(depth * precision)
![Page 34: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/34.jpg)
Functionality of Approximate HE
Packing Technique§ R=Z[X] / (Φm(X)).§ Φ(X) = ∏i(X- ζi) where ζi’s are m-th roots of unity.§ Encoding map: from (Mi)i to M(X) such that M(ζi) = Mi
![Page 35: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/35.jpg)
Functionality of Approximate HE
Packing Technique
§ R=Z[X] / (Φm(X)).
§ Φ(X) = ∏i(X- ζi) where ζi’s are m-th roots of unity.
§ Encoding map: from (Mi)i to M(X) such that M(ζi) = Mi
Rotation, Conjugation
§ Evaluation of σ(X)=Xk in Gal( K=Q[X]/(XN+1) / Q ).
§ Based on the key-switching technique.
![Page 36: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/36.jpg)
Functionality of Approximate HE
Packing Technique
§ R=Z[X] / (Φm(X)).
§ Φ(X) = ∏i(X- ζi) where ζi’s are m-th roots of unity.
§ Encoding map: from (Mi)i to M(X) such that M(ζi) = Mi
Rotation, Conjugation
§ Evaluation of σ(X)=Xk in Gal( K=Q[X]/(XN+1) / Q ).
§ Based on the key-switching technique.
Evaluation of Analytic Functions
§ exp (z),
§ z-1
![Page 37: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/37.jpg)
Bootstrapping for the Approximate HE (EC’18)Decryption circuit§ M = <ct, sk> (mod q).§ Goal: Represent modular reduction as a circuit over the complex numbers.
![Page 38: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/38.jpg)
Bootstrapping for the Approximate HE (EC’18)Decryption circuit§ M = <ct, sk> (mod q).§ Goal: Represent modular reduction as a circuit over the complex numbers.
![Page 39: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/39.jpg)
Bootstrapping for the Approximate HE (EC’18)Decryption circuit§ M = <ct, sk> (mod q). M ≈ (q/2π) sin θ, θ = (2π/q) <ct,sk>.§ Goal: Represent modular reduction as a circuit over the complex numbers.
![Page 40: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/40.jpg)
Bootstrapping for the Approximate HE (EC’18)Decryption circuit§ M = <ct, sk> (mod q). M ≈ (q/2π) sin θ, θ = (2π/q) <ct,sk>.§ Goal: Represent modular reduction as a circuit over the complex numbers.
Evaluation of sine§ cos θ = cos2(θ/2) – sin2(θ/2), sinθ = 2 cos(θ/2) sin(θ/2).
![Page 41: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/41.jpg)
Bootstrapping for the Approximate HE (EC’18)Decryption circuit§ M = <ct, sk> (mod q). M ≈ (q/2π) sin θ, θ = (2π/q) <ct,sk>.§ Goal: Represent modular reduction as a circuit over the complex numbers.
Evaluation of sine§ cos θ = cos2(θ/2) – sin2(θ/2), sinθ = 2 cos(θ/2) sin(θ/2).§ From [-2Kπ/2r, 2Kπ/2r] to [-2K π, 2K π].§ Linear Complexity for Modulus Reduction Operation!§ <ct’,sk> (mod Q) ≈ M
![Page 42: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/42.jpg)
Following Work
Privacy-preserving Training of Logistic Regression Model§ Kim-Song-Wang-Xia-Jiang, JMIR Med Inform’18§ Kim-Song-Kim-Lee-Cheon, iDASH P&S Workshop’17, BMC Med Genomics’18 (in submission).
e.g. Six minutes to obtain a LR model from dataset of size 1579 * (18+1).§ (ongoing) ML based on the financial data with Bootstrapping.
![Page 43: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/43.jpg)
Following Work
Privacy-preserving Training of Logistic Regression Model§ Kim-Song-Wang-Xia-Jiang, JMIR Med Inform’18§ Kim-Song-Kim-Lee-Cheon, iDASH P&S Workshop’17, BMC Med Genomics’18 (in submission).
e.g. Six minutes to obtain a LR model from dataset of size 1579 * (18+1).§ (ongoing) ML based on the financial data with Bootstrapping.
A Full-RNS Variant of Approx-HE§ Double-CRT (RNS+NTT) representation.§ Implementation without CRT composition or big-integer library.§ Based on the use of approximate basis & approximate modulus switching.
![Page 44: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/44.jpg)
Following Work
Privacy-preserving Training of Logistic Regression Model§ Kim-Song-Wang-Xia-Jiang, JMIR Med Inform’18§ Kim-Song-Kim-Lee-Cheon, iDASH P&S Workshop’17, BMC Med Genomics’18 (in submission).
e.g. Six minutes to obtain a LR model from dataset of size 1579 * (18+1).§ (ongoing) ML based on the financial data with Bootstrapping.
A Full-RNS Variant of Approx-HE§ Double-CRT (RNS+NTT) representation.§ Implementation without CRT composition or big-integer library.§ Based on the use of approximate basis & approximate modulus switching.
Open problems??
![Page 45: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/45.jpg)
Homomorphic Encryption Framework
O
![Page 46: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/46.jpg)
Homomorphic Encryption Framework
O
m1
m2
![Page 47: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/47.jpg)
Homomorphic Encryption Framework (Encryption)
O
m1
m2 Enc(m2)
Enc(m1)
![Page 48: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/48.jpg)
Homomorphic Encryption Framework (Addition)
O
m1
m2
m3=m1+m2
Enc(m2)
Enc(m1)
![Page 49: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/49.jpg)
Homomorphic Encryption Framework (Addition)
O
m1
m2
m3=m1+m2
Enc(m2)
Enc(m1)
Enc(m1)+Enc(m2)
![Page 50: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/50.jpg)
Homomorphic Encryption Framework (Addition)
O
m1
m2
m3=m1+m2
Enc(m2)
Enc(m1)
Enc(m1)+Enc(m2)
![Page 51: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/51.jpg)
Homomorphic Encryption Framework (Multiplication)
O
m1
m2 Enc(m2)
Enc(m1)
![Page 52: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/52.jpg)
Homomorphic Encryption Framework (Multiplication)
O
m1
m2 Enc(m2)
Enc(m1)
m3=m1*m2
![Page 53: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/53.jpg)
Homomorphic Encryption Framework (Multiplication)
O
m1
m2 Enc(m2)
Enc(m1)
Enc(m1)*Enc(m2)
m3=m1*m2
![Page 54: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/54.jpg)
Homomorphic Encryption Framework (Multiplication)
O
m1
m2 Enc(m2)
Enc(m1)
Enc(m1)*Enc(m2)
m3=m1*m2
![Page 55: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/55.jpg)
Homomorphic Encryption Framework (Multiplication)
O
m1
m2 Enc(m2)
Enc(m1)
Enc(m1)*Enc(m2)
m3=m1*m2
![Page 56: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/56.jpg)
Approximate Homomorphic Encryption
O
![Page 57: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/57.jpg)
Approximate Homomorphic Encryption
O
![Page 58: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/58.jpg)
Approximate Homomorphic Encryption
O
m2
m1
![Page 59: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/59.jpg)
Approximate Homomorphic Encryption (Encryption)
O
m2m1’=m1+e1
m2’=m2+e2m1
![Page 60: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/60.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2m1’
m2’m1
![Page 61: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/61.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2m1’
m2’
m1+m2
m1
![Page 62: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/62.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2m1’
m2’
m1+m2 m1’+m2’ ≈ m1+m2
m1
![Page 63: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/63.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2m1’
m2’
m1+m2 m1’+m2’
m1
![Page 64: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/64.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2
m1+m2
m1*m2
m2’
m1’+m2’
m1’
m1
![Page 65: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/65.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2
m1+m2
m1*m2
m1’*m2’≈ m1*m2
m2’
m1’+m2’
m1’
m1
![Page 66: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/66.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2
m1+m2
m1*m2
m1’*m2’
m2’
m1’+m2’
m1’
m1
![Page 67: Approximate Homomorphic Encryption - Yongsoo Song · Application Researches of HE (2017~2018) “HomomorphicEncryption” in ePrintand IEEE Xplore Machine Learning: 11 (2018/233,202,139,074,](https://reader033.fdocuments.us/reader033/viewer/2022060517/604aaeaa94e5ca0ee2738e84/html5/thumbnails/67.jpg)
Approximate Homomorphic Encryption (Operations)
O
m2
m1
m1+m2
m1*m2
m2’
m1’+m2’
m1’
m1’*m2’
¼ m1’*m2’≈ ¼ m1*m2