# US 12,763,925 B2 · Method and apparatus with linearly homomorphic encryption > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,763,925 B2 - Document ID: US12763925B2 - Status: Granted - Kind: B2 - Application number: 19/036,281 - Filed: 2025-01-24 - Published: 2025-12-25 - Granted: 2026-10-13 - Earliest claimed: 2024-06-20 - Assignees: Samsung Electronics Co., Ltd.; Seoul National University R&Db Foundation - Applicants: Samsung Electronics Co., Ltd.; Seoul National University R&DB Foundation - Inventors: Yongsoo Song; Seonhong Min - Web page: https://patentgrep.com/patent/US12763925B2 ## CPC - H04L 9/008: {involving homomorphic encryption} - H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A linearly homomorphic encryption (LHE) method and apparatus are disclosed. An LHE method that provides circuit privacy, according to one embodiment, is performed by a computing device and may include: receiving a homomorphic ciphertext of input data from a sender; sampling a coefficient of a linear function from a first discrete Gaussian distribution corresponding to a coset of a plaintext modulus; sampling a first noise from a predefined second discrete Gaussian distribution; and generating a homomorphic ciphertext of an evaluation result on the input data from the linear function, based on the sampled coefficient of the linear function and the sampled first noise. ## Claims ### Claim 1 A linearly homomorphic encryption (LHE) method that provides circuit privacy, the LHE method performed by one or more processors of a first computing device, the LHE method comprising: receiving, via a network by the first computing device, a homomorphic ciphertext of input data from a sender comprising a second computing device; sampling, by the first computing device, a coefficient of a linear function from a first discrete Gaussian distribution corresponding to a coset of a plaintext modulus; sampling, by the first computing device, a first noise from a predefined second discrete Gaussian distribution; generating, by the first computing device, based on the sampled coefficient of the linear function and the sampled first noise, a homomorphic ciphertext of an evaluation result on the input data from the linear function; and transmitting the homomorphic ciphertext from the first computing device via the network to the second computing device. ### Claim 2 (depends on 1) The LHE method of claim 1, wherein the homomorphic ciphertext of the input data is generated by encrypting a result of a number-theoretic transform (NTT) operation corresponding to the plaintext modulus of the input data, based on a public key corresponding to a secret key of the sender and a second noise sampled from a third discrete Gaussian distribution. ### Claim 3 (depends on 1) The LHE method of claim 1, wherein the receiving of the homomorphic ciphertext of the input data comprises: further receiving a public key corresponding to the homomorphic ciphertext of the input data. ### Claim 4 (depends on 1) The LHE method of claim 1, wherein the generating of the homomorphic ciphertext of the evaluation result comprises: encrypting a constant term of the linear function, based on a public key corresponding to the homomorphic ciphertext of the input data, the first noise, and a ciphertext modulus; and generating the homomorphic ciphertext of the evaluation result by adding the encrypted constant term of the linear function to a product of the sampled coefficient of the linear function and the homomorphic ciphertext of the input data. ### Claim 5 (depends on 1) The LHE method of claim 1, wherein the linear function is defined based on a slope coefficient and a constant term coefficient on a polynomial ring and a residue ring for the plaintext modulus. ### Claim 6 (depends on 1) The LHE method of claim 1, wherein the homomorphic ciphertext of the input data comprises a Brakerski/Fan-Vercauteren (BFV) ciphertext. ### Claim 7 (depends on 1) The LHE method of claim 1, wherein the first discrete Gaussian distribution comprises: a discrete Gaussian distribution corresponding to a first width parameter in an integer lattice space of the coset of the plaintext modulus that is an equivalence class of a modulo operation on the coefficient of the linear function and the plaintext modulus. ### Claim 8 (depends on 1) The LHE method of claim 1, wherein the second discrete Gaussian distribution comprises: a discrete Gaussian distribution in an integer lattice space corresponding to a second width parameter. ### Claim 9 (depends on 1) The LHE method of claim 1, wherein a first width parameter of the first discrete Gaussian distribution and a second width parameter of the second discrete Gaussian distribution are determined based on a smoothing parameter of an integer lattice space of the coset and a stochastic maximum value of a third discrete Gaussian distribution in which a second noise corresponding to the homomorphic ciphertext of the input data is sampled. ### Claim 10 (depends on 1) The LHE method of claim 1, further comprising: transmitting the homomorphic ciphertext of the evaluation result to the sender. ### Claim 11 (depends on 1) The LHE method of claim 1, wherein the sender is configured to acquire the evaluation result on the input data from the linear function by decrypting the homomorphic ciphertext of the evaluation result based on a secret key corresponding to the homomorphic ciphertext of the input data. ### Claim 12 (depends on 1) A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform the LHE method of claim 1. ### Claim 13 An electronic device, comprising: one or more processors; and a memory storing instructions, wherein the instructions, when executed by the one or more processors, cause the one or more processors to: receive a homomorphic ciphertext of input data from a sender computing device via a network; sample a coefficient of a linear function from a first discrete Gaussian distribution corresponding to a coset of a plaintext modulus; sample a first noise from a predefined second discrete Gaussian distribution; generate, based on the sampled coefficient of the linear function and the sampled first noise, a homomorphic ciphertext of an evaluation result on the input data from the linear function; and transmit the homomorphic ciphertext to the sender computing device. ### Claim 14 (depends on 13) The electronic device of claim 13, wherein the homomorphic ciphertext of the input data is generated by encrypting a result of a number-theoretic transform (NTT) operation corresponding to the plaintext modulus of the input data, based on a public key corresponding to a secret key of the sender and a second noise sampled from a third discrete Gaussian distribution. ### Claim 15 (depends on 13) The electronic device of claim 13, wherein the receiving of the homomorphic ciphertext of the input data comprises: further receiving a public key corresponding to the homomorphic ciphertext of the input data. ### Claim 16 (depends on 13) The electronic device of claim 13, wherein the generating of the homomorphic ciphertext of the evaluation result comprises: encrypting a constant term of the linear function, based on a public key corresponding to the homomorphic ciphertext of the input data, the first noise, and a ciphertext modulus; and generating the homomorphic ciphertext of the evaluation result by adding the encrypted constant term of the linear function to a product of the sampled coefficient of the linear function and the homomorphic ciphertext of the input data. ### Claim 17 (depends on 13) The electronic device of claim 13, wherein the first discrete Gaussian distribution comprises: a discrete Gaussian distribution corresponding to a first width parameter in an integer lattice space of the coset of the plaintext modulus that is an equivalence class of a modulo operation on the coefficient of the linear function and the plaintext modulus. ### Claim 18 (depends on 13) The electronic device of claim 13, wherein the second discrete Gaussian distribution comprises: a discrete Gaussian distribution in an integer lattice space corresponding to a second width parameter. ### Claim 19 (depends on 13) The electronic device of claim 13, wherein a first width parameter of the first discrete Gaussian distribution and a second width parameter of the second discrete Gaussian distribution are determined based on a smoothing parameter of an integer lattice space of the coset and a stochastic maximum value of a third discrete Gaussian distribution in which a second noise corresponding to the homomorphic ciphertext of the input data is sampled. ### Claim 20 (depends on 13) The electronic device of claim 13, wherein the instructions, when executed by the one or more processors, cause the electronic device further to: transmit the homomorphic ciphertext of the evaluation result to the sender.