# Privacy Protection of IoT Based on Fully Homomorphic Encryption

Authors: Wei-Tao Song; Bin Hu; Xiu-Feng Zhao
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

With the rapid development of Internet of Things (IoT), grave questions of privacy protection are raised. This greatly impacts the large-scale applications of IoT. Fully homomorphic encryption (FHE) can provide privacy protection for IoT. But, its efficiency needs to be greatly improved. Nowadays, Gentry’s bootstrapping technique is still the only known method of obtaining a “pure” FHE scheme. And it is also the key for the low efficiency of FHE scheme due to the complexity homomorphic decryption. In this paper, the bootstrapping technique of Halevi and Shoup (EUROCRYPT 15) is improved. Firstly, by introducing a definition of “load capacity”, we optimize the parameter range for which their bootstrapping technique works. Next we generalize their ciphertext modulus from closing to a power of two to more general situations. This enables the method to be applied in a larger number of situations. Moreover, this paper also shows how to introduce SIMD homomorphic computation techniques into the new method, to improve the efficiency of recryption.


---

## Body

## 1. Introduction

Nowadays, the IoT is becoming an attractive system paradigm to drive a substantive leap on goods and services through physical, cyber, and social spaces. It covers from traditional equipment to general household equipment, which bring more efficiency and convenience to the users and change current ways of life greatly [1]. See Figure 1.Figure 1
IoT architecture.However, the application of IoT involves mass private information about users, such as healthcare, location, etc. For the users, they want service providers to process the data accurately and efficiently and extract the contained valuable information with keeping user data unknown by others (including themselves). All these problems are difficult to achieve by traditionally encryption schemes. Homomorphic encryption technology is a good choice to solve all these problems [2, 3].FHE permits a worker to perform arbitrarily complex programs on encrypted data without knowing the secret key [4]. And FHE has been the focus of extensive study [5–13], since the first candidate scheme was introduced by Gentry [14]. But its efficiency needs to be greatly improved.Since bootstrapping technology is the essential technology to obtain a “pure” FHE at present. Meanwhile, it is also the main bottleneck in any practical implementation due to the complexity homomorphic decryption. It is very meaningful to improve the efficiency of bootstrapping, which mainly refers to fast low-circuit implementation of decryption function. Without loss of generality, the decryption function for LWE- (Learning with Errors-) based FHE can be computed by evaluating some linear operation between ciphertext and secret key, then reducing the result modulo a big odd modulusq and then reducing the result modulo a small modulus p, to get the plaintext m, namely, m=Lcsqp. For the decryption function, the modular-reduction operation of [[z]q]p (z∈Z) affects the depth of decryption circuit most.The past few years have seen an intensive study of bootstrapping technique. In the original bootstrapping technique of Gentry [14], he put forward an idea of “squash the decryption circuit” to transform modular-reduction operation into summing operation. This got a moderate polynomial O(λ4) runtime. By proposed an amortized bootstrapping method, Brakerski, Gentry, and Vaikuntanathan (BGV) reduced the runtime to O(λ2) [10]. However, these results applied only to “non-packed” ciphertexts (i.e., ones that encrypt just one bit each).Gentry, Halevi, and Smart (GHS, PKC2012) reached a major milestone of a bootstrapping algorithm concentrating on the BGV ring-LWE-based scheme (ideal lattice-based FHE) [15]. They proposed a simpler decryption formula. This is done by choosing a prime plaintext modulus p and a ciphertext modulus q close to a power of p. Besides, they utilized packed ciphertexts and Fourier Transform to aid efficiency. To improve the Fourier Transform step of [15], [16] presented a ring/field switching technique. This obtained an asymptotically efficient bootstrapping method for BGV style SHE scheme. Orsini, Pol, and Smart (PKC15) proposed a bootstrapping BGV ciphertexts with a wider choice of p and q, but their decryption formula was not simple as GHS’s work. Halevi and Shoup (HS, EUROCRYPT 15) generalized the plaintext modulus p in [17] to more general situations and got a better efficiency by improving the bit-extraction way. This is asymptotically optimal space and time so far.In another line of work, [18–22] present a bootstrapping technique for the GSW-FHE [13] scheme. They get significant progress in improving the bootstrapping technique on standard lattice-based FHE. And their progress mainly relies on the characteristic that noise in ciphertexts of GSW-FHE grows asymmetrically. Since compared with standard LWE-based FHE schemes, ring-LWE-based FHE schemes always have more efficient homomorphic operations. And among all the ring-LWE-based FHE schemes, BGV ring-LWE-based FHE scheme is optimal (note that GSW-FHE scheme is better than BGV-FHE scheme only in standard LWE-based FHE schemes). Note that, in this paper, the aim is to provide practical FHE scheme for the privacy protection of IoT. Thus, it concentrates on improving the bootstrapping technique of BGV ring-LWE-based FHE schemes in this paper.The starting point of this paper is the HS’s work [17], where decryption procedure consists of a linear algebra step <c,s> and a modular reduction step zqp. When |z|≤q2/4-q and |[z]q|≤q/4, modular reduction step zqp can be converted to simple bit operations. This greatly reduces the circuit depth of modular reduction. When homomorphically performed above simple decryption formula, the deepest part is homomorphic bit-extraction procedure, and its complexity (both time and depth) increases with the most-significant extracted bit. In [17], by adding to ciphertext multiples of q and also multiples of p, they proposed a lower-degree homomorphic bit-extraction procedure. And the bigger the parameter range of z for the simple formula of modular reduction, the better the performance for the improved homomorphic bit-extraction procedure. See [17] for further details.Contributions. In this paper, we optimize the parameters of bootstrapping algorithm proposed in EUROCRYPT 2015 by Halevi and Shoup. Firstly, by introducing a definition of load capacity, we optimize the parameters range for which their bootstrapping technique works for the first time. Next we generalize their ciphertext modulus q to more general situations. This makes our method applicable to more cases. Moreover, we also show how to introduce SIMD technique into our new method, to improve the efficiency of bootstrapping technique.Organization. Section 2 presents the notations and some background on the BGV cryptosystem. Section 3 optimizes the parameter range for which bootstrapping technique of Halevi and Shoup works. Next, the ciphertext modulus is generalized from closing to a power of two to more general situations in Section 4. Moreover, it also shows how to introduce SIMD homomorphic computation techniques into the new method to get an efficient bootstrapping method. And in Section 5, an implementation is made of BGV ring-LWE-based scheme based on our efficient bootstrapping method. Finally, Section 6 concludes.


## 2. Preliminaries

Basic Notations. Set Zq∈(-q/2,q/2]⋂Z, and the notation aq is referred to as a mod q, with coefficients being reduced into the range (-q/2,q/2]. For an integer z (positive or negative), we consider the base-p representation of z and denote its digits by z0p,z1p,⋯.


### 2.1. Homomorphic Encryption Schemes

LetM be the message space and C be the ciphertext space. A homomorphic encryption scheme HE={KeyGen,Enc,Dec,Eval} is as follows:(i)
KeyGen(1λ): output public key pk, secret key sk, and evaluation key evk.(ii)
Encpkμ: output ciphertext c∈C encrypted by plaintext μ∈M with public key pk.(iii)
Decskc: recover the message encrypted in the ciphertext c by secret key sk.(iv)
Evalevkf,c1,…,cl: output ciphertext cf∈C which is obtained by applying evaluation key evk and the function f:Ml→M to c1,…,cl.Suppose that(sk1,pk1) and (sk2,pk2) are two key-pairs of scheme HE. Let c be a ciphertext of plaintext μ under pk. Let sk1i¯ be a ciphertext of the i-th bit of the first secret key sk1 under the second public key pk2. D is a decryption circuit. See Algorithm 1 for the “Bootstrapping” algorithm.Algorithm 1:“Bootstrapping” algorithm.
Input: p k 2, D,sk1i¯, c Output: c ′ S tep 1. c i ¯ ← R H E . E n c ( p k 2 , c i ) where ci is the i-bit of c S tep 2. c ′ ← H E . E v a l p k 2 , D , s k 1 i ¯ , c i ¯It can be found thatHE.Decsk2,c′=HE.Decsk1,c=μ only when scheme HE can compactly evaluate its decryption circuit. However, most of the existing schemes do not satisfy this condition naturally. It needs some extra operations, such as “squashing the decryption circuit”, which cause the low efficiency of FHE. Thus, it is very meaningful for lower-depth circuit implementation of decryption function.


## 2.1. Homomorphic Encryption Schemes

LetM be the message space and C be the ciphertext space. A homomorphic encryption scheme HE={KeyGen,Enc,Dec,Eval} is as follows:(i)
KeyGen(1λ): output public key pk, secret key sk, and evaluation key evk.(ii)
Encpkμ: output ciphertext c∈C encrypted by plaintext μ∈M with public key pk.(iii)
Decskc: recover the message encrypted in the ciphertext c by secret key sk.(iv)
Evalevkf,c1,…,cl: output ciphertext cf∈C which is obtained by applying evaluation key evk and the function f:Ml→M to c1,…,cl.Suppose that(sk1,pk1) and (sk2,pk2) are two key-pairs of scheme HE. Let c be a ciphertext of plaintext μ under pk. Let sk1i¯ be a ciphertext of the i-th bit of the first secret key sk1 under the second public key pk2. D is a decryption circuit. See Algorithm 1 for the “Bootstrapping” algorithm.Algorithm 1:“Bootstrapping” algorithm.
Input: p k 2, D,sk1i¯, c Output: c ′ S tep 1. c i ¯ ← R H E . E n c ( p k 2 , c i ) where ci is the i-bit of c S tep 2. c ′ ← H E . E v a l p k 2 , D , s k 1 i ¯ , c i ¯It can be found thatHE.Decsk2,c′=HE.Decsk1,c=μ only when scheme HE can compactly evaluate its decryption circuit. However, most of the existing schemes do not satisfy this condition naturally. It needs some extra operations, such as “squashing the decryption circuit”, which cause the low efficiency of FHE. Thus, it is very meaningful for lower-depth circuit implementation of decryption function.


## 3. Analysis of HS Recryption Procedure

We start by introducing the HS recryption procedure [17] on that how to homomorphically compute the modular-reduction operation in a lower-depth circuit. The specifics are in Lemma 1.Lemma 1 (see [17]).
Letp>1, r≥1, e≥r+2 and q=pe+1 be integers, and also let z be an integer such that z≤q2/4-q and zq≤q/4.(i)
Ifp is odd then zq=z<r-1,⋯,0>-z<e+r-1,⋯,e>(mod⁡pr).(ii)
Ifp=2 then zq=z<r-1,⋯,0>-z<e+r-1,⋯,e>-z<e-1>(mod⁡2r).Lemma1 transforms complex modular operations into simple bit operation, to get a lower-depth circuit of decryption function. But it is still not easy to execute a homomorphic bit-extraction operation. Next, [17] proposed a fast bit-extraction procedure. As stated in the former introduction, the performance of fast bit-extraction procedure is dependent on the parameter range of z in Lemma 1. That is, the bigger parameter range of z, the better performance of fast bit-extraction procedure. Thus, next we analyse whether the parameter range of z in Lemma 1 is optimal. In order to do so, we introduce a new concept called “load capacity”.Definition 2 (load capacity).
Letq∈Z+, z∈Z. Suppose the formula of modular reduction converted to simple bit operations works when -q/2<a≤zq≤b≤q/2, and c≤z<d. Then the load capacity is defined by the product of two span lengths of z and zq, namely, (b-a)×(d-c).Next Theorem3 presents the general relationship between the value z and zq for the formula of modular reduction converted to simple bit operations.Theorem 3.
Letp>1, r≥1, e≥r+2 and q=pe+1 be integers, and also let z be an integer such that zq∈a,b, and let a·(1-q)≤z<(q-1)×(q-b). Then(i)
ifp is odd then zq=z<r-1,⋯,0>-z<e+r-1,⋯,e>(mod⁡pr);(ii)
ifp=2 then zq=z<r-1,⋯,0>-z<e+r-1,⋯,e>-z<e-1>(mod⁡2r).Proof.
It starts with the odd-p case. Let z0=zq∈[a,b] and z=z0+k·q with k∈Z. Then(1)z=z0+k·pe+1=z0+k+k·pe.Since e≥r+2, we can get that(2)z=z0+kmod⁡pr.Besides, since(3)a·1-q≤z<q-1×q-b,z0+k=z0+z-z0q=z+z0q-1q,then(4)z0+k∈a·1-q+z0q-1q,q-1×q-b+z0q-1q.And since -q/2≤a≤z0≤b≤q/2, then(5)z0+k∈a·1-q+aq-1q,q-1×q-b+bq-1q=0,pe.Thus, combined with formula (2), we can get that(6)kr-1,⋯,0=ze+r-1,⋯,e,where k<r-1,⋯,0> and z<e+r-1,⋯,e> are mod-p representation. Then it follows that (7)z0r-1,⋯,0=zr-1,⋯,0-kr-1,⋯,0=zr-1,⋯,0-ze+r-1,⋯,emod⁡pr.The proof for the p=2 case is similar. The details can be referred to in the proof of [17]. It is omitted here.Next we discuss how to choose the value ofa,b in order to obtain the maximum “load capacity”. Load capacity is denoted by t, then (8)t=q-1·q-b-a1-q·b-a=1-q·b-a2+qq-1·b-a.Let x=b-a, then t=(1-q)·x2+q(q-1)·x. The concrete relations are as shown in Figure 2Figure 2
The load capacity on the span length ofa and b.It can be easily seen from Figure2 that the load capacity takes the maximum value when b-a=q/2. That is, the load capacity for HS work is only related to the span length, not to the value of a and b. Then Corollary 4 presents the optimal choice of zq and z for the formula of modular reduction converted to simple bit operations.Corollary 4.
Letp>1, r≥1, e≥r+2, q=pe+1 and a∈(-q/2,0] be integers, and also let z be an integer such that z∈Z,zq∈a,a+q/2, and a·(1-q)≤z<(q-1)×(q/2-a).(i)
Ifp is odd then [z]q=z<r-1,⋯,0>-z<e+r-1,⋯,e>(mod⁡pr).(ii)
Ifp=2 then [z]q=z<r-1,⋯,0>-z<e+r-1,⋯,e>-z<e-1>(mod⁡2r).
The conclusion is obvious; the proof is omitted here.Note that, whena=-q/4, namely, zq≤q/4, it is the same as HS’s work. But, the load capacity of this paper is bigger than that of HS’s work, since z of ours has a bigger span length, namely, z≤q2/4-q/4. The details are present in Table 1.Table 1
The parameter of low-circuit implementation of modular reduction on HS and our work.
Scheme z z q load capacity HS’ work [17] [ q - q 2 \ 4 , q 2 \ 4 - q ] [ - q \ 4 , q \ 4 ] q 3 / 4 - q 2 Our work (a∈(-q/2,0]) a ⋅ ( 1 - q ) , ( q - 1 ) × ( q / 2 - a ) a , a + q / 2 q 3 / 4 - q 2 / 4As seen from Table1, compared to HS’ work, it can be seen that our scheme has a better load capacity. Note that, while on the surface, it appears to obtain a tiny improvement in a nondominant term, i.e., where the load capacity of the choice in HS is q3/4-q2, this is improved to q3/4-q2/4, it is actually a meaningful job when you carefully analyse the principle of the trick of the fast bit-extraction procedure in [17]. That is, add to the coefficients of ct multiples of q and pr, making them divisible by pe′ for some r≤e′<e without increasing them too much and also without increasing the noise too much. This means that bit-extraction can be implemented using only polynomials of degree at most e-e′, smaller than e. Since the load capacity of this paper is 3q2\4 bigger than that of HS’s work, it means our work allows adding more multiples of q and pr to the coefficients of ct. That is, bit-extraction can be implemented using polynomials of lower degree to get a faster implementation. Besides, our variant of HS is more flexible and general on parameters.


## 4. Generalize Modulus to More General Situations

In this section, it extends HS recryption procedure to have a wider choice of ciphertext modulus. The specifics are in Theorem5.Theorem 5.
Letp>1, r≥1, e≥r+2, and q=u·pe+v with u,v∈Z and u∈1,pr-1, v∈1,pe-1, p∤u,v, also let z be an integer such that zq∈a,b, and(9)a·v-qv≤z<b·v-q+peqv.Then,(i)
ifp is odd then zq=z<r-1,⋯,0>-v<r-1,⋯,0>×z<e+r-1,⋯,e>/u<r-1,⋯,0>(mod⁡pr),(ii)
ifp=2 then zq=z<r-1,⋯,0>-((v<r-1,⋯,0>)×(z<e+r-1,⋯,e>))/u<r-1,⋯,0>-z<e-1>(mod⁡pr),
where “×”refers to scalar multiplication.Proof.
We begin with the odd-p case. Let z0=zq∈[a,b] and z=z0+k·q with k∈Z. Then(10)z=z0+k·u·pe+v=z0+kv+ku·pe.Since e≥r+2, we can get that(11)z=z0+kvmod⁡pr.Besides, since(12)a·v-qv≤z<b·v-q+peqv,z0+kv=z0+z-z0qv=zv+z0q-vq,then(13)z0+kv∈a·v-q/vv+z0q-vq,b·v-q+peq/vv+z0q-vq.And since -q/2≤a≤z0≤b≤q/2, then(14)z0+kv∈a·v-q+aq-vq,b·v-q+peq+bq-vq=0,pe.Thus, combined with formula (11), we can get that (15)zr-1,⋯,0=z0r-1,⋯,0+kr-1,⋯,0×vr-1,⋯,0mod⁡prze+r-1,⋯,e=kr-1,⋯,0×ur-1,⋯,0mod⁡prp∤u,vThus,(16)zq=zr-1,⋯,0-vr-1,⋯,0×ze+r-1,⋯,eur-1,⋯,0mod⁡pr.
The proof for thep=2 case is similar. We omit it here.Next we discuss how to choose the value ofa,b in order to obtain the maximum “load capacity”. Load capacity is denoted by t, then (17)t=b·v-q+peqv-a·v-qv·b-a=v-qv·b-a2+q-vquv·b-a.Let x=b-a, then(18)t=v-qv·x2+q-vquv·x.It is easy to get thatt takes the maximum value when(19)x=q-vq/uv-2v-q/v=q2u.That is, the load capacity is also only related to the span length, not to the value of a and b.Then Corollary6 presents the optimal choice of zq and z for the formula of modular reduction converted to simple bit operations.Corollary 6.
Letp>1, r≥1, e≥r+2 and q=u·pe+v with u,v∈Z and u∈1,pr-1, v∈1,pe-1, p∤u,v, also let z be an integer such that zq∈a,a+q/2u, and(20)a·v-qv≤z<q2-v+2auq+2auv2uv.
Then(i)
ifp is odd then [z]q=z<r-1,⋯,0>-(((v<r-1,⋯,0>)×(z<e+r-1,⋯,e>))/u<r-1,⋯,0>)(mod⁡pr);(ii)
ifp=2 then [z]q=z<r-1,⋯,0>-((v<r-1,⋯,0>)×(z<e+r-1,⋯,e>))/u<r-1,⋯,0>-z<e-1>(mod⁡pr).
The conclusion is obvious; the proof is omitted here.To get a homomorphic implementation of the simple decryption formula from above, firstly a homomorphic bit-extraction procedure (Algorithm2) is presented, which is slightly varied from the bit-extraction procedure of [17].Algorithm 2:Bit-extraction (c,r,e,p).
Input: Modulus q=u⋅pe+v, and a ciphertext c encrypting a constant b∈(Z/pe+1Z) relative to secret key s and modulus pe+1 Output: A ciphertext c′ encrypting the bit operation relative to secret key s and modulus pe 1. Set c0←c//c encrypt z w.r.t. s 2. For i=1 to r 3. Set acc←c // acc is an accumulator 4. For j=0 to i=1//Compute z-∑jpjwji-1 5. Set tmp←HomExp(cj,pi-j) //Homomorphic exponentiation to the power pi-j 6. Set acc←acc-pj⋅tmpmod⁡pr+1 7. Set ci←acc⋅((q0+1)/p)imod⁡pr+1 // encrypts z<i>p 8. Output c0-v0p/u0pcrmod⁡pr+1H o m E x p ( c , n ) uses native homomorphic multiplication to multiply operatornamec by itself n times. To aid exposition, this code assumes that the modulus and secret key remain fixed; otherwise modulus-switching and key-switching should be added (and the level should be increased correspondingly to some i>0).Then Algorithm3 shows how to combine our optimized “bootstrapping” techniques with the SIMD homomorphic computation techniques of Smart-Vercauteren [23], to get a bootstrapping method that works in time quasilinear in the security parameter.Algorithm 3:Batched bootstrapping implementation of our scheme.
Step 1. The user first post-processes the qL-secret-key by encrypting s as a q0-ciphertext c′=(c0′,c1′) with respect to the q0-secret-key s′=(1,s), namely the user has < c ′ , s ′ > mod ⁡ Φ m q 0 = c 0 ′ , c 1 ′ ⋅ s  mod ⁡ Φ m q 0 = p r + 1 ⋅ k + s where k∈Z[X]/Φm(X) with small coefficients. Step 2. The server computes z homomorphically. Specifically, the server compute the mod-pr+1 inner product homomorphically by setting z ~ = c 0 + c 1 ⋅ c 0 ′ mod ⁡ Φ m q 0 , c 1 ⋅ c 1 ′ mod ⁡ Φ m q 0 . Step 3. Apply a homomorphic inverse-DFT transformation to convert to CRT-based “packed” ciphertexts that hold the coefficients of z in their plaintext slots. Step 4. Apply the bit extraction procedure to all these slots in parallel. The result is encryption of polynomials that have the coefficients of z in their plaintext slots. Step 5. Apply a homomorphic DFT transformation to get back a ciphertext that encrypts the polynomial z itself.


## 5. Implementation and Performance

In this section, an implementation of BGV ring-LWE-based scheme is made, since it offers nearly the most efficient homomorphic operations. This scheme is defined over a ringR=defZ[X]/(Φm(X)), where Φm(X) is the m th cyclotomic polynomial. Let p be a prime or a prime power, and Ap≔ZpX/Φm(X). Specifically, assume Φm(X)≡F1(X)⋯Fl(X)(mod⁡p), where each Fi has the same degree d, which is equal to the order of p modulo m. Then, by the Chinese Remainder Theorem, it has the isomorphism Rp≅⨁i=1k(Z[X]/(p,Fi(X)). Besides, suppose sk=(1,s) is the qL-secret-key, where s∈Z[X]/Φm(X) is an integer polynomial with small coefficients. sk′=(1,s′) is the q0-secret-key. c=(c0,c1) is the qL-ciphertext.First, several groups(m,p,r) are chosen which satisfy Φm(X)≡F1(X)⋯Fl(X)(mod⁡p). For each triple (m,p,q), a test is run separately based on our work and HS’ work. These tests were run on a four-year-old IBM System x3850 server, with two 64-bit 4-core Intel Xeon E5450 processors, and 35MB L2 cache and 32GB of RAM at 3.0 GHz. And the implementation was mainly based on Shoup’s NTL library [23] version 9.10.0 and GNU’s GMP library [24]. The former is used for high-level numeric algorithms, and the latter is used for the underlying integer arithmetic operations. Besides, the code was compiled using the gcc compiler (version 4.9.1). Table 2 summarizes the results from our experiments based on our work and HS’.Table 2
Experimental results for our batched bootstrapping and HS.
cyclotomic ringm plaintext space number of slots security level total recrypt (sec) space usage (GB) Our work HS’ work Our work HS’ work 21845=257⋅5⋅17 2 16 1024 76 97 172 2.3 3.0 18631=601⋅31 2 25 720 110 168 235 2.6 3.2 45551=41⋅11⋅101 1 7 40 1000 106 1475 2037 11.2 13.8 51319=19⋅73⋅37 12 7 36 1296 161 984 1461 31.7 36.4The first column gives cyclotomic ring m and its factorization into prime powers. The second column gives the plaintext space, i.e., the field/ring that is embedded in each slot. The third column gives the number of slots packed into a single ciphertext. The fourth column gives the effective security level, computed using the formula that is used in HElib taken from [15, Eqn. (8)]. The total recrypt gives the total time for a single recryption, while the previous two rows give a breakdown of that time (note that the time for the linear transforms includes some trivial preprocessing time, as well as the less trivial unpacking/repacking time). The last two rows give the memory used (in gigabytes).As seen from Table2, compared to HS’ work, it can be easy seen that the variant of HS has advantages both in efficiency and in storage space. Besides the variant of HS is more flexible and general on parameters. This enables our method to be applied in a larger number of situations.


## 6. Conclusions

Up to now, Gentry’s bootstrapping technique is still the only known method of obtaining a “pure” FHE scheme. Meanwhile it is also the key for the low efficiency of FHE scheme. It is very meaningful to improve the efficiency of bootstrapping, which mainly refers to lower-depth circuit implementation of decryption function. In this paper, it improves the “load capacity” of HS’s work with a better efficiency for bootstrapping and to generalizeq to more general situations in a similar simple way. This enables our method to be applied in a larger number of situations, such as privacy protection of IoT.



---

*Source: 5787930-2018-06-20.xml*