Approximate Homomorphic Encryption and Privacy Preserving Machine - - PowerPoint PPT Presentation

β–Ά
approximate homomorphic encryption
SMART_READER_LITE
LIVE PREVIEW

Approximate Homomorphic Encryption and Privacy Preserving Machine - - PowerPoint PPT Presentation

Dec 29, 2022 472 likes β€’983 views

Approximate Homomorphic Encryption and Privacy Preserving Machine Learning Jung Hee Cheon (SNU, CryptoLab) Thanks to YongSoo Song, Kiwoo Lee, Andrey KIM Outline 1. Homomorphic Encryption 2. HEAAN 3. Bootstrapping of HEAAN 4. Toolkit for

slide-1
SLIDE 1

Jung Hee Cheon (SNU, CryptoLab)

Approximate Homomorphic Encryption and Privacy Preserving Machine Learning

Thanks to YongSoo Song, Kiwoo Lee, Andrey KIM

slide-2
SLIDE 2
  • 1. Homomorphic Encryption
  • 2. HEAAN
  • 3. Bootstrapping of HEAAN
  • 4. Toolkit for Homomorphic Computation

Outline

slide-3
SLIDE 3

 Integer-based HE scheme

  • RAD PH[1]
  • (Secret Key, Operation Key) = (a large prime π‘ž, π‘œ = π‘žπ‘Ÿ0)
  • Encryption: πΉπ‘œπ‘‘ 𝑛 = 𝑛 + π‘žπ‘Ÿ 𝑛𝑝𝑒 π‘œ
  • Decryption: πΉπ‘œπ‘‘ 𝑛

𝑛𝑝𝑒 π‘ž = 𝑛

  • πΉπ‘œπ‘‘ 𝑛1 + πΉπ‘œπ‘‘ 𝑛2 = 𝑛1 + π‘žπ‘Ÿ1 + 𝑛2 + π‘žπ‘Ÿ2

= 𝑛1 + 𝑛2 + π‘ž π‘Ÿ1 + π‘Ÿ2 = πΉπ‘œπ‘‘ 𝑛1 + 𝑛2

  • DGHV HE scheme (on β„€2)[2]
  • πΉπ‘œπ‘‘(𝑛 ∈ π‘Ž2100) = 𝑛 + 2100𝑓 + π‘žπ‘Ÿ
  • SECURE against quantum computing
  • Use a polynomial ring π‘†π‘Ÿ = β„€π‘Ÿ[𝑦]/(π‘¦π‘œ + 1)

Homomorphic Encryption

But, INSECURE!

2100𝑓1 𝑛1 2100𝑓2 𝑛2

2200𝑓1𝑓2 + 2100 𝑛1𝑓2 + 𝑛2𝑓1 +

𝑛1𝑛2

X

slide-4
SLIDE 4
  • On Polynomials (RingLWE)
  • [Gen09] ideal lattice
  • NTRU: LTV12
  • Ring-LWE: BV11b, GHS13, BLLN13, HEAAN etc
  • On Integers (AGCD)
  • [DGHV10] FHE over the Integers. Eurocrypt 2010
  • CMNT11, CNT12, CCKLLTY13, CLT14, etc
  • On Matrices (LWE)
  • [BV11a] Efficient FHE from (Standard) LWE. FOCS11
  • Bra12, BGV12, GSW13

Fully Homomorphic Encryption

slide-5
SLIDE 5
  • 1. 2009~2012: Plausibility and Scalable for Large Circuits
  • [GH11] A single bit bootstrapping takes 30 minutes
  • [GHS12b] 120 blocks of AES-128 (30K gates) in 36 hours
  • 2. 2012~2015: Depth-Linear Construction
  • [BGV12] Modulus/Key Switching
  • [Bra12] Scale Invariant Scheme
  • [HS14] IBM's open-source library Helib: AES evaluation in 4 minutes
  • 3. 2015~Today: Usability
  • Various schemes with different advantages (HEAAN, TFHE)
  • Real-world tasks: Big data analysis, Machine learning
  • Competitions for Private Genome Computation (iDash, 2014~)
  • HE Standardization meetings (2017~)

Continued on next page

Summary of Progress in HE

slide-6
SLIDE 6

Standardization: HomomorphicEncryption.org

1st Workshop (2017.7.13-14) 2nd Workshop (2018.3.15-16) 3rd Workshop (2018.10.20)

Jul 2017 in Microsoft, Redmond Mar 2018 in MIT Oct 2018 in Toronto

slide-7
SLIDE 7

 Best Performing HE Schemes

Type Classical HE Fast Bootstrapping Approximate Computation Scheme [BGV12] BGV [Bra12, FV12] B/FV [DM15] FHEW [CGGI16] TFHE [CKKS17] HEAAN Plaintext Finite Field Packing Binary string Real/Complex numbers Packing Operation Addition, Multiplication Look-up table & bootstrapping Fixed-point Arithmetic Library HElib (IBM) SEAL (Microsoft Research) Palisade (Duality inc.) TFHE (Inpher, Gemalto, etc.) HEAAN (SNU)

Homomorphic Encryption

slide-8
SLIDE 8
  • 2. HEAAN: Approximate Homomorphic Encryption
slide-9
SLIDE 9

Exact Multiplication

1.23 4.56 0.78 0.91 5.6088 0.7098 3.98112624 2.34 5.67 8.91 0.23 13.2678 2.0493 27.18970254 108.2456382397886496

  • The plaintext size is doubled after a multiplication.

2 4 8 16

slide-10
SLIDE 10

Approximate Multiplication

HEAAN [CKKS17]

  • Rescale after a multiplication
  • Tracing # of significands
  • Most data is processed approximately in Data analysis or ML

1.23 4.56 0.78 0.91 5.6188 0.7198 3.98112624 2.34 5.67 8.91 0.23 13.2778 2.0593 27.19970254 108.2556382397886496 2 2 2 2

slide-11
SLIDE 11

HEAAN = ζ…§ηœΌ = Insightful Minds

[CKKS, AC17] Homomorphic Encryption for Arithmetic of Approximate Numbers https://eprint.iacr.org/2016/421.pdf

slide-12
SLIDE 12

 Numerical Representation

  • Encode 𝑛 into an integer 𝑛 β‰ˆ π‘žπ‘¦ for a scaling factor π‘ž : 2 ↦ 1412 β‰ˆ

2 β‹… 103

  • Fixed–Point Multiplication
  • Compute 𝑛 = 𝑛1𝑛2 and extract its significant digits 𝑛′ β‰ˆ π‘žβˆ’1 β‹… 𝑛

: 1.234 Γ— 5.678 = 1234 β‹… 10βˆ’3

Γ— 5678 β‹… 10βˆ’3 = 7006652 β‹… 10βˆ’6 ↦ 7007 β‹… 10βˆ’3 = 7.007

 Previous HE on LWE problem (Regev, 2005)

  • ct = Encsk 𝑛 , ct, sk = π‘Ÿ

𝑒 𝑛 + 𝑓 mod π‘Ÿ

  • Modulo 𝑒 plaintext vs Rounding operation

Approximate Computation

𝑛 π‘Ÿ/𝑒 𝑓 𝑒

slide-13
SLIDE 13

 A New Message Encoding

  • ct = Encsk 𝑛 , ct, sk = π‘žπ‘› + 𝑓

mod π‘Ÿ

  • Consider 𝑓 as part of approximation error

 Homomorphic Operations  Support for the (approximate) fixed-point arithmetic

  • Leveled HE : π‘Ÿ = π‘žπ‘€

HEAAN

Input 𝜈1 β‰ˆ π‘žπ‘›1, 𝜈2 β‰ˆ π‘žπ‘›2 Addition 𝜈1 + 𝜈2 β‰ˆ π‘ž β‹… (𝑛1 + 𝑛2) Multiplication 𝜈 = 𝜈1𝜈2 β‰ˆ π‘ž2 β‹… 𝑛1𝑛2 Rounding πœˆβ€² β‰ˆ π‘žβˆ’1 β‹… 𝜈 β‰ˆ π‘ž β‹… 𝑛1𝑛2 𝜈1 = π‘žπ‘›1 + 𝑓1 π‘Ÿ 𝜈2 = π‘žπ‘›2 + 𝑓2 𝜈 = π‘ž2𝑛1𝑛2 + 𝑓 πœˆβ€² = π‘ž β‹… 𝑛1𝑛2 + 𝑓′ π‘Ÿ/π‘ž

slide-14
SLIDE 14

 Construction over the ring

  • A single ctx can encrypt a vector of plaintext values 𝑨 = (𝑨1, 𝑨2, … , 𝑨ℓ)
  • Parallel computation in a SIMD manner 𝑨 βŠ— π‘₯ = (𝑨1π‘₯1, 𝑨2π‘₯2, … , 𝑨ℓπ‘₯β„“)

HEAAN Packed Ciphertext

Continued on next page

slide-15
SLIDE 15

 Let 𝑆 = β„€ π‘Œ π‘Œπ‘œ + 1 and π‘†π‘Ÿ = 𝑆 mod π‘Ÿ = β„€π‘Ÿ π‘Œ π‘Œπ‘œ + 1

  • A ciphertext can encrypt a polynomial 𝑛 π‘Œ ∈ 𝑆
  • Note (m0+m1X+ … ) (m0’+m1’X+ … )= m0m0’+(m0m1’ +m0’m1)X+…
  • Decoding/Encoding function

𝑆 = β„€ π‘Œ π‘Œπ‘œ + 1 βŠ† ℝ π‘Œ π‘Œπ‘œ + 1 β†’ β„‚π‘œ/2 where π‘Œπ‘œ + 1 = π‘Œ βˆ’ πœ‚1 π‘Œ βˆ’ πœ‚1

βˆ’1

π‘Œ βˆ’ πœ‚2 π‘Œ βˆ’ πœ‚2

βˆ’1 β‹― π‘Œ βˆ’ πœ‚ π‘œ 2

π‘Œ βˆ’ πœ‚

π‘œ 2 βˆ’1

  • Example: π‘œ = 4, πœ‚1 = π‘“π‘¦π‘ž(πœŒπ‘—/4), πœ‚2 = π‘“π‘¦π‘ž(5πœŒπ‘—/4)
  • 𝑨 = 1 βˆ’ 2𝑗, 3 + 4𝑗 ↦ 𝑛 π‘Œ = 2 βˆ’ 2 2 π‘Œ + π‘Œ2 βˆ’

2 π‘Œ3

  • ↦ 𝜈 π‘Œ = 2000 βˆ’ 2828π‘Œ + 1000π‘Œ2 βˆ’ 1414 π‘Œ3
  • 𝜈 πœ‚1 β‰ˆ 1000.15 βˆ’ 1999.55 𝑗, 𝜈 πœ‚2 β‰ˆ 2999.85 + 3999.55 𝑗

RLWE-based HEAAN

𝑛 π‘Œ ↦ 𝑨 = 𝑨1, … , π‘¨π‘œβˆ•2 , 𝑨𝑗 = 𝜈 πœ‚π‘— ,

slide-16
SLIDE 16
  • 3. Bootstrapping of HEAAN
slide-17
SLIDE 17

Bootstrapping

Decryption

πΉπ‘œπ‘‘π‘™(𝐿) πΉπ‘œπ‘‘(𝑑)

c = πΉπ‘œπ‘‘π‘™(𝑛; 𝑠) 𝐿 𝑛

πΉπ‘œπ‘‘π‘™ 𝑛; 𝑠′ , 𝑠′: small

Safe Box

[1] Cheon-Han-Kim-Kim-Song: Bootstrapping for Approximate Homomorphic Encryption. EUROCRYPT 2018

  • Old Ciphertext with large noise
  • Encrypted Secret Key
  • New ciphertext with small noise
  • Evaluate Decrypt circuit

Input Output Process

slide-18
SLIDE 18
  • Ciphertexts of a leveled HE have a limited lifespan
  • Refresh a ciphertext ct = Encsk 𝑛

by evaluating the decryption circuit homomorphically : Decsk ct = 𝑛 ⟺ 𝐺ct sk = 𝑛 where 𝐺ct βˆ— = Decβˆ— ct

  • Bootstrapping key BK = Encsk(sk)

: 𝐺ct BK = 𝐺ct Encsk sk = Encsk 𝐺ct sk = Encsk(𝑛)

  • Homomorphic operations introduce errors  Fine

: 𝐺ct BK = 𝐺ct Encsk sk = Encsk 𝐺ct sk + 𝑓 = Encsk(𝑛 + 𝑓)

  • How to evaluate the decryption circuit (efficiently)?

: Decsk ct = ct, sk (mod π‘Ÿ)

Bootstrapping

slide-19
SLIDE 19

𝐸𝑓𝑑𝑑𝑙 𝑑𝑒 ↦ 𝑒 = 𝑑𝑒, 𝑑𝑙 ↦ 𝑒 π‘Ÿ = 𝜈, 𝑒 = π‘Ÿπ½ + 𝜈 for some 𝐽 < 𝐿

  • NaΓ―ve solution: polynomial interpolation on [βˆ’πΏπ‘Ÿ, πΏπ‘Ÿ]
  • Huge depth, complexity & inaccurate result

Approximate Decryption

slide-20
SLIDE 20

𝐸𝑓𝑑𝑑𝑙 𝑑𝑒 ↦ 𝑒 = 𝑑𝑒, 𝑑𝑙 ↦ 𝑒 π‘Ÿ = 𝜈, 𝑒 = π‘Ÿπ½ + 𝜈 for some 𝐽 < 𝐿

  • Idea1: Restriction of domain 𝜈 β‰ͺ π‘Ÿ

Approximate Decryption

slide-21
SLIDE 21
  • Idea1: Restriction of domain 𝜈 β‰ͺ π‘Ÿ
  • Idea 2: Sine approximation 𝜈 β‰ˆ π‘Ÿ

2𝜌 sin πœ„ for πœ„ = 2𝜌 π‘Ÿ 𝑒 (period:π‘Ÿ, slope at 0=1)

π‘Ÿ 1

𝐸𝑓𝑑𝑑𝑙 𝑑𝑒 ↦ 𝑒 = 𝑑𝑒, 𝑑𝑙 ↦ 𝑒 π‘Ÿ = 𝜈, 𝑒 = π‘Ÿπ½ + 𝜈 for some 𝐽 < 𝐿

Approximate Decryption

slide-22
SLIDE 22

 Sine Evaluation

Bootstrapping of HEAAN

slide-23
SLIDE 23

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity

Bootstrapping of HEAAN

slide-24
SLIDE 24

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

Bootstrapping of HEAAN

slide-25
SLIDE 25

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

1

Bootstrapping of HEAAN

slide-26
SLIDE 26

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

2

Bootstrapping of HEAAN

slide-27
SLIDE 27

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

3

Bootstrapping of HEAAN

slide-28
SLIDE 28

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

4

Bootstrapping of HEAAN

slide-29
SLIDE 29

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

5

Bootstrapping of HEAAN

slide-30
SLIDE 30

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

6

Bootstrapping of HEAAN

slide-31
SLIDE 31

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

7

Bootstrapping of HEAAN

slide-32
SLIDE 32

 Sine Evaluation

  • Direct Taylor approximation
  • Huge depth & complexity
  • Idea 1: Low-degree approx. near 0
  • 𝐷0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙 !

πœ„ 2𝑠 2𝑙 β‰ˆ cos πœ„ 2𝑠

  • 𝑇0 πœ„ = 𝑙=0

𝑒 βˆ’1 𝑙 2𝑙+1 !

πœ„ 2𝑠 2𝑙+1 β‰ˆ sin( πœ„ 2𝑠)

  • Idea 2: Iterate by double-angle formula
  • 𝐷𝑙+1 πœ„ = 𝐷𝑙

2 πœ„ βˆ’ 𝑇𝑙 2 πœ„ , 𝑇𝑙+1 πœ„ = 2𝑇𝑙 πœ„ β‹… 𝐷𝑙 πœ„

  • Numerically stable & Linear complexity

𝑇𝑠 πœ„ β‰ˆ sin πœ„

8

Bootstrapping of HEAAN

slide-33
SLIDE 33

 Iteration vs Direct Computation

  • 𝑇𝑠(πœ„) is obtained from 𝑇0(πœ„) and 𝐷0(πœ„) by 𝑠 iterations
  • One computation of Double–angle formula: 2 squarings + 1 addition
  • 𝑠 iterations take 2𝑠 squarings + 𝑠 additions
  • Degree of 𝑇𝑠(πœ„) β‰ˆ 2𝑠
  • Direct Taylor Approximation
  • 2𝑠 multiplications to get 2𝑠 degree approximation π‘ˆ2𝑠 of sine function

Bootstrapping of HEAAN

slide-34
SLIDE 34

 Slot-Coefficient Switching

  • Ring–based HEAAN
  • Homomorphic operations on plaintext slots, not on coefficients
  • We need to perform the modulo reduction on coefficients
  • Pre/post computation before/after sine evaluation
  • Depth consumption: Sine evaluation
  • Complexity: Slot-Coefficient switchings (# of slots)
  • Performance of Bootstrapping
  • Experimental Results
  • 127 + 12 = 139 s / 128 slotsΓ—12 bits
  • 456 + 68 = 524 s / 128 slotsΓ—24 bits

Coefficient Plaintext Slots ℝ π‘Œ π‘Œπ‘œ + 1 β„‚

π‘œ 2

𝑒 π‘Œ = π‘Ÿ β‹… 𝐽 π‘Œ + 𝜈(π‘Œ) (𝑒0,𝑒1,… π‘’π‘œβˆ’1) (𝜈0, 𝜈1,… , πœˆπ‘œβˆ’1) 𝜈 π‘Œ = 𝜈0 + β‹― + πœˆπ‘œβˆ’1π‘Œπ‘œβˆ’1 β‘  coeff to slot β‘‘ sine eval β‘’ slot to coeff

Bootstrapping of HEAAN

slide-35
SLIDE 35

Speed of FHE

2011 2013 2014 2015 2016 2018 1-bit Amortized

1bit, 1800s 1bit, 0.7s 1bit, 0.052s *120s, 250K bit 172s, 531bit 320s, 16K bit

οƒΌ 1800s β†’ 0.05s (1bit) οƒΌ 1800s β†’ 0.00046s (Amortized) : 30K~300K times

*[CHH18]Faster Homomorphic Discrete Fourier Transforms and Improved FHE Bootstrapping, eprint, 1073, 2018/ Intel Xeon CPU E5-2620 2.10GHz, 64RAM

[GH11] Implementing Gentry’s Fully-Homomorphic Encryption Scheme, Eurocrypt 2011. [CCK+13] Batch Fully Homomorphic Encryption over the Integers, Eurocrypt 2013. [CLT14] Scale-Invariant Fully Homomorphic Encryption over the Integers, PKC 2014. [HS15] Bootstrapping for Helib, Eurocrypt 2015 [DM15] FHEW: Boostrapping Homomorpic Encryption in Less Than a Second, Eurocrypt 2015. [CGGI16] Faster Fully Homomorphic Encryption: Bootstrapping in less than 0.1 Seconds, Asiacrypt 2016.

slide-36
SLIDE 36

Secure Genome Analysis Competition

Hosted by by Sp Sponsored by by AIM AIM

Privacy Preserving Genom Analysis

slide-37
SLIDE 37

Slide Courtesy of Xiaoqian Jiang (β–³ = too small iteration β†’ hard to adapt for other data) Rank 1 3 β–³ β–³ 2 X X

2017 Track 3: Logistic Regression Training on Encrypted Data

slide-38
SLIDE 38

2018 Track 2 : Secure Parallel Genome Wide Association Studies using HE

Team Submission Schemes End to End Performance Evaluation result ( F1- Score ) at different cutoffs Running time (mins) Peak Memory (M) 0.01 0.001 0.0001 0.00001 Gold Semi Gold Semi Gold Semi Gold Semi A*FHE A*FHE -1 + HEAAN 922.48 3,777 0.977 0.999 0.986 0.999 0.985 0.999 0.966 0.998 A*FHE -2 1,632.97 4,093 0.882 0.905 0.863 0.877 0.827 0.843 0.792 0.826 Chimera Version 1 + TFHE & HEAAN (Chimera) 201.73 10,375 0.979 0.993 0.987 0.991 0.988 0.989 0.982 0.974 Version 2 215.95 15,166 0.339 0.35 0.305 0.309 0.271 0.276 0.239 0.253 Delft Blue Delft Blue HEAAN 1,844.82 10,814 0.965 0.969 0.956 0.944 0.951 0.935 0.884 0.849 UC San Diego Logistic Regr + HEAAN 1.66 14,901 0.983 0.993 0.993 0.987 0.991 0.989 0.995 0.967 Linear Regr 0.42 3,387 0.982 0.989 0.980 0.971 0.982 0.968 0.925 0.89 Duality Inc Logistic Regr + CKKS (Aka HEAAN), pkg: PALISADE 3.8 10,230 0.982 0.993 0.991 0.993 0.993 0.991 0.990 0.973 Chi2 test 0.09 1,512 0.968 0.983 0.981 0.985 0.980 0.985 0.939 0.962 Seoul National University SNU-1 HEAAN 52.49 15,204 0.975 0.984 0.976 0.973 0.975 0.969 0.932 0.905 SNU-2 52.37 15,177 0.976 0.988 0.979 0.975 0.974 0.969 0.939 0.909 IBM IBM-Complex CKKS (Aka HEAAN), pkg: HElIb 23.35 8,651 0.913 0.911 0.169 0.188 0.067 0.077 0.053 0.06 IBM- Real 52.65 15,613 0.542 0.526 0.279 0.28 0.241 0.255 0.218 0.229

Slide Courtesy of Xiaoqian Jiang

slide-39
SLIDE 39
  • 4. T

Too

  • olkit

it for

  • r H

Hom

  • mom
  • mor
  • rphic

hic Com

  • mput

utati ation

  • n
slide-40
SLIDE 40

 Packing Method

  • HEAAN supports vector operations
  • How can we compute matrix operations for ciphertexts?
  • Matrix Encoding method

How

  • w to
  • Pack

ck

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Encode

1 2 β‹― 16

𝑑 = πΉπ‘œπ‘‘( )

slide-41
SLIDE 41

 Packing Method

  • Matrix addition : trivial
  • Matrix multiplication : non-trivial (exercise)
  • Row/column rotation?

How

  • w to
  • ro

rotate

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 4 1 2 3 8 5 6 7 12 9 10 11 16 13 14 15

𝑠𝑝𝑒 𝑑, 1 = πΉπ‘œπ‘‘(

16 1 β‹― 15

) =

16 1 2 3 4 5 6 7 18 9 10 11 12 13 14 15

(wrong)

slide-42
SLIDE 42

 Packing Method

  • Solution : using masking vector

How

  • w to
  • ro

rotate

16 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

βŠ™

1 1 1 1 1 1 1 1 1 1 1 1

=

1 2 3 5 6 7 9 10 11 13 14 15

𝑠𝑝𝑒 𝑑, 1 βŠ™ 𝑛𝑏𝑑𝑙 =

4 5 6 7 8 9 10 11 12 13 14 15 16 1 2 3

βŠ™

1 1 1 1

=

4 8 12 16

𝑠𝑝𝑒 𝑑, βˆ’3 βŠ™ 𝑛𝑏𝑑𝑙′ = ∴ π·π‘π‘šπ‘†π‘π‘’ (𝑑) = 𝑠𝑝𝑒 𝑑, 1 βŠ™ 𝑛𝑏𝑑𝑙 + 𝑠𝑝𝑒 𝑑, βˆ’3 βŠ™ 𝑛𝑏𝑑𝑙′ =

4 1 2 3 8 5 6 7 12 9 10 11 16 13 14 15

slide-43
SLIDE 43

 Message Space

  • Bit-wise HE: β„€2={0,1} with logical gates
  • Good at gate operations but slow at arithmetic.
  • Word-wise HE: β„‚ or β„€π‘ž with add. & mult.
  • Good at poly evaluation but hard to evaluate non-poly function.

 Idea: Use Polynomial Approximation for Non-Poly Functions!

  • Don’t use naΓ―ve Taylor Approx. It is local i.e. approx at a point
  • Minimize errors on an interval
  • Methods: Least Square, Chevyshev, Minimax …

Polynomial Approximation

slide-44
SLIDE 44

Application : Homomorphic Logistic Regression [HHCP]

  • Need to evaluate sigmoid function : 1/(1+exp(-x))
  • Real Financial Large Data (Provided by KCB)
  • About 400,000 samples with 200 features.
  • Target value = β€œcredit score”

Polynomial Approximation

slide-45
SLIDE 45

 Idea: π·π‘π‘›π‘ž 𝑏, 𝑐 = lim

π‘™β†’βˆž 𝑏𝑙 𝑏𝑙+𝑐𝑙 for a,b>0

  • 1. Compute approximately (Take only the msb of the results)
  • 2. Choose k as a power of 2
  • 3. Use iteration algorithms for division

Comparison

Method hod Scheme eme (Amor mortized) tized) Ru Runnin nning tim ime # of pair irs Error Bit-wise HElib β‰ˆ 1 ms 1800 TFHE β‰ˆ 1 ms

  • Ours

s

(W (Word rd-wi wise se)

HEAA AAN 0.73 ms 216 < 2-8

slide-46
SLIDE 46

 General Max 𝑁𝑏𝑦 𝑏1, … , 𝑏𝑒 = lim

π‘™β†’βˆž 𝑏1

𝑙+1+β‹―+𝑏𝑒 𝑙+1

𝑏1𝑙+β‹―+𝑏𝑒𝑙

for ai>0  2nd 𝑁𝑏𝑦 𝑏1, … , 𝑏𝑒 = lim

π‘™β†’βˆž 𝑏1

𝑙+1+β‹―+𝑏𝑒 𝑙+1βˆ’π‘›π‘π‘¦π‘™+1

𝑏1𝑙+β‹―+π‘π‘’π‘™βˆ’π‘›π‘π‘¦π‘™

 Applications: k-max, threshold counting, clustering, …

Min/Max

slide-47
SLIDE 47

 Fast\Merge Sort: O(klogk)

  • Comparison-based algorithm doesn’t work on HE
  • We cannot check min-max condition

 Sorting Network: O(klog2k)

  • Comparison network that always sort their inputs
  • Data-independent algorithm

 Results

  • 64 slots : about 12 min. (previous work : 42 min. [EGN+15])
  • 32,768 slots : about 10.5 hour (previous work: impractical)

So Sort rting ng on

  • n E

Enc ncry rypted Data

slide-48
SLIDE 48

 Basic Tools:  Packing, Matrix Operation, Comparison, Approximate inv/sigmoid,  Decision Tree: Packing, Comparison  Boosting: Comparison and Gradient Decent  Deep Neural Network: Fast matrix operations + Approximate  Convolution Neural Network: + Comparison

Toward

  • ward Hom
  • mom
  • mor
  • rphi

phic c Ma Mach chine ne Learn rning ng

slide-49
SLIDE 49

 HEAAN natively supports for the (approximate) fixed point arithmetic  Ciphertext modulus log π‘Ÿ = 𝑀 log π‘ž grows linearly  Useful when evaluating analytic functions approximately:

  • Polynomial
  • Multiplicative Inverse
  • Trigonometric Functions
  • Exponential Function (Logistic Function, Sigmoid Function)

 Packing technique based on DFT

  • SIMD (Single Instruction Multiple Data) operation
  • Rotation on plaintext slots:

HEAAN: Summary

𝑨 = 𝑨1, … , 𝑨

π‘œ 2

↦ 𝑨′ = (𝑨2, … , 𝑨

π‘œ 2, 𝑨1)

slide-50
SLIDE 50

Thank you for your attention! κ°μ‚¬ν•©λ‹ˆλ‹€.