NTRU型多密钥全同态加密方案的优化

现有的NTRU型多密钥全同态加密方案多是基于2的幂次分圆多项式环构造的，全同态计算过程使用了复杂的密钥交换操作，这类方案容易遭受子域攻击，且同态运算效率较低，对此本文提出了一个安全性更好、效率更高的NTRU型多密钥全同态加密方案。首先，将现有方案底层的分圆多项式环扩展应用到素数次分圆多项式环上，给出了基于素数次分圆多项式环的NTRU型多密钥全同态加密的基础方案模型（文中B-MKFHE方案），该方案模型可以抵御更多的子域攻击。其次，在B-MKFHE方案模型的基础上，通过扩展密文多项式维度，优化了NTRU多密钥同态运算结构，使得同态运算过程不再需要复杂耗时的密钥交换操作。最后，根据优化的多密钥同态运算结构，结合模交换技术，构造了无需密钥交换的层级型NTRU多密钥全同态加密方案（文中M-MKFHE方案）。通过与现有方案对比分析，本文提出的M-MKFHE方案改进了底层的分圆多项式环，提高了安全性；优化的同态运算结构具有较小的存储开销和计算开销，运算效率较高，并且方案在同态运算过程中产生的噪声值较小，支持更深层次的同态运算。

Optimization of NTRU-type Multi-key Fully Homomorphic Encryption Scheme

The previous NTRU-type multi-key fully homomorphic encryption (MKFHE) schemes were constructed over power-of-2 cyclotomic polynomial rings. And the complicated key-switching operations were used in the schemes to complete the fully homomorphic computation. So, they were suffered from the subfield attacks and had low evaluating efficiency. To this end, an NTRU-type MKFHE scheme with better security and higher efficiency was proposed. Firstly, the prime cyclotomic polynomial ring was applied to the previous NTRU-type MKFHE schemes. And an NTRU-type MKFHE basic scheme model (denote B-MKFHE in this paper) over prime cyclotomic polynomial ring was given, which could resist more subfield attacks. Secondly, based on the B-MKFHE model, the NTRU-type multi-key homomorphic evaluating structure was optimized by extending the dimension of ciphertext polynomial, thus the complicated and time-consuming key-switching operations were eliminated when running the homomorphic operations. Finally, combined the improved multi-key homomorphic evaluating structure with modulus-switching technology, a leveled NTRU-type MKFHE scheme (denote M-MKFHE in this paper) without key-switching operations was constructed. Compared with the previous schemes, the security of the proposed scheme was improved because of the based prime cyclotomic polynomial ring. As the memory (bit-size) and evaluating costs were reduced, the evaluating efficiency was improved. Meanwhile, the error magnitude was decreased in the homomorphic evaluating process, so the scheme supported deeper homomorphic evaluations.