Fig. 2

Matrix arithmetic operations supported by COLLAGENE. a A matrix is flattened into an array and encrypted using the public key. Encryption output a series of ciphertexts, each of which contains a pair of polynomials in the ring \({Z}_{q}\left[X\right]/\left({X}_{q}^{N}+1\right)\), details of which are encapsulated by COLLAGENE. Elementwise multiplication is illustrated between \(3\times 3\) matrices (middle). Row expansion of a matrix is illustrated for a \(3\times 3\) matrix (bottom). b Multiplication of two matrices (\(A\) and \(B\)) is illustrated using the column and row expansions, denoted by \({ce}_{\cdot }^{(3)}(A)\), and \({re}_{\cdot }^{(3)}(B)\). Multiplication is calculated as the inner product of the expansion matrices, denoted by \(\langle {ce}_{\cdot }^{\left(3\right)}\left(A\right),{re}_{\cdot }^{\left(3\right)}\left(B\right)\rangle\). c Secure row-row inner product of two matrices by shift-and-add operations. Given \(A\) and \(B\) matrices of size 2 × 4, row-row inner product is a \(2\times 1\) vector whose entries are the inner products of rows of \(A\) and \(B\) (top). To calculate the inner products, the ciphertext that corresponds to the elementwise multiplication of the matrices (\(A\odot B\)) is shifted and added recursively (Bottom). The flattened representations of matrices stored in the ciphertexts are colored to indicate rows of \(A\) and \(B\). At each step, the inner product ciphertext is circularly rotated using Galois keys and added to the current ciphertext. The rotations are depicted by arrows to show the rotated entries. Gray shaded entries indicate unused entries. After 2 rotations, the row-row inner products for each row are stored in orange and green entries. These entries are masked and copied to the final row-row inner product ciphertext, \({\langle A,B\rangle }_{r2r}\). d Collaborative matrix inversion protocol that utilizes matrix masking to calculate the inverse of a matrix. Three sites would like to invert the summation of local matrices \({X}_{1}\), \(X\), and \({X}_{3}\) that stores sensitive data. Each site first generates a masking matrix \({M}_{1}\), \({M}_{2}\), \({M}_{3}\), then encrypt them and upload to the shared space. Next, sites locally pool the mask matrices \({M}_{123}={M}_{1}+{M}_{2}+{M}_{3}\) to generate the collective encrypted mask. Sites locally multiply the collective mask with their matrix, i.e., site-1 securely multiplies \({X}_{1}\times {M}_{123}\), and upload to the shared space. Each site downloads the masked matrices and pools the matrices to calculate \({X}_{123}\times {M}_{123}\), which is still encrypted. The sites collectively decrypt this matrix, then locally invert the decrypted matrix, which yields \({M}_{123}^{-1}\times {X}_{123}\). Sites finally multiply the inverted matrix on the left with \({M}_{123}\), which results in the \({X}_{123}^{-1}\). The row and column expansions are not shown for the sake of simplicity