Homomorphic encryption-based ciphertext data outsourcing decryption system and method

Abstract

The application provides a ciphertext data outsourcing decryption system and method based on homomorphic encryption. The outsourcing decryption system comprises a data application party and a decryption platform. The data application party comprises a data storage unit, a random number generation unit, a confusion unit, a data application side communication unit and a de-confusion unit. The decryption platform comprises a platform side communication unit and a homomorphic decryption unit. The data storage unit stores ciphertext data. The random number generation unit generates random numbers. The confusion unit uses the random numbers to perform confusion processing on the ciphertext data to obtain ciphertext confusion data based on the characteristic that homomorphic encryption can perform plaintext and ciphertext operation. The data application side communication unit sends the ciphertext confusion data to the decryption platform. The homomorphic decryption unit uses a decryption key to perform homomorphic decryption on the ciphertext confusion data to obtain plaintext confusion data. The platform side communication unit sends the plaintext confusion data to the data application party. The de-confusion unit uses the random numbers to perform de-confusion processing on the plaintext confusion data to obtain plaintext data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data encryption and decryption, and particularly relates to a ciphertext data outsourcing decryption system and method based on homomorphic encryption. BACKGROUND

[0002] At present, the information age has come, and various big data applications have penetrated into all aspects of life. If data leakage occurs during data transmission, the impact is immeasurable, so data encryption has emerged as the times require.

[0003] The data provider encrypts the plaintext data, and correspondingly, the data application party needs to decrypt the encrypted ciphertext data. The decryption process of the traditional password must be completed locally. If the data is outsourced to a third party for decryption, there is a problem of data leakage in the transmission process and the trustworthiness of the third party, which has great security risks and is contrary to the original intention of data encryption. Therefore, the traditional password cannot realize data outsourcing decryption.

[0004] With the advent of the data era, the amount of data is becoming larger and larger, and the processing capacity of the server required for data decryption is becoming stronger and stronger. Therefore, it is necessary to develop a new technology to realize data security while allowing a third party with powerful servers to decrypt data, rather than upgrading the local server. SUMMARY

[0005] The application is carried out to solve the above problems, and aims to provide a ciphertext data outsourcing decryption system and method based on homomorphic encryption with high security.

[0006] In order to achieve the above purpose, the application adopts the following scheme:

[0007] <Scheme 1>

[0008] The application provides a ciphertext data outsourcing decryption system based on homomorphic encryption, which has the characteristics that the system comprises a data application party and an encryption and decryption platform connected with the data application party through a communication network, wherein the data application party comprises a data storage unit, a random number generation unit, a confusion unit, a data application side communication unit and a de-confusion unit, the encryption and decryption platform comprises a platform side communication unit and a homomorphic decryption unit, the data storage unit stores ciphertext data homomorphic encrypted by using an encryption key, the random number generation unit generates random numbers, the confusion unit uses the random numbers to perform confusion processing on the ciphertext data to obtain ciphertext confusion data based on the characteristic that the homomorphic encryption can perform plaintext-ciphertext operation, the data application side communication unit sends the ciphertext confusion data to the encryption and decryption platform, once the platform side communication unit receives the ciphertext confusion data, the homomorphic decryption unit uses a decryption key to perform homomorphic decryption on the ciphertext confusion data to obtain plaintext confusion data, the platform side communication unit sends the plaintext confusion data to the data application party, and once the data application side communication unit receives the plaintext confusion data, the de-confusion unit uses the random numbers to perform de-confusion processing on the plaintext confusion data to obtain plaintext data.

[0009] In the ciphertext data outsourcing decryption system based on homomorphic encryption provided by the application, the system can further have the characteristics that the system further comprises a key management party in communication connection with the encryption and decryption platform through a communication network, wherein the key management party comprises a key generation unit and a key management side communication unit, the key generation unit is used for generating a decryption key, and the key management side communication unit sends the decryption key to the encryption and decryption platform.

[0010] In the ciphertext data outsourcing decryption system based on homomorphic encryption provided by the application, the system can further have the characteristics that the key management side communication unit sends the decryption key to the encryption and decryption platform in the form of a key envelope.

[0011] In the ciphertext data outsourcing decryption system based on homomorphic encryption provided by the application, the system can further have the characteristics that the encryption and decryption platform further comprises a key generation unit, and the key generation unit is used for generating a decryption key.

[0012] In the ciphertext data outsourcing decryption system based on homomorphic encryption provided by the application, the system can further have the characteristics that the homomorphic encryption is full homomorphic encryption or semi-homomorphic encryption.

[0013] In the ciphertext data outsourcing decryption system based on homomorphic encryption provided by the application, the system can further have the characteristics that the operation method of the confusion processing is addition, subtraction, multiplication or division, and the operation method of the de-confusion processing is subtraction, addition, division or multiplication correspondingly.

[0014] In the homomorphic encryption-based ciphertext data outsourcing decryption system provided by the application, the data application side communication unit can send the ciphertext confusion data to the encryption and decryption platform through an SSL secure channel.

[0015] <Plan two>

[0016] The application further provides a homomorphic encryption-based ciphertext data outsourcing decryption method, which has the following characteristics and comprises the following steps.

[0017] The generating unit generates a random number;

[0018] The ciphertext data is confused by using the random number based on the characteristic that the homomorphic encryption can perform plaintext and ciphertext operation, to obtain ciphertext confusion data;

[0019] The ciphertext confusion data is sent to the encryption and decryption platform;

[0020] Once the ciphertext confusion data is received, the ciphertext confusion data is homomorphic decrypted by using a decryption key to obtain plaintext confusion data;

[0021] The plaintext confusion data is sent to the data application party;

[0022] Once the plaintext confusion data is received, the plaintext confusion data is deconfused by using the random number to obtain plaintext data.

[0023] Effects of the application

[0024] According to the homomorphic encryption-based ciphertext data outsourcing decryption system and method provided by the application, the ciphertext data is confused by using the random number based on the characteristic that the homomorphic encryption can perform plaintext and ciphertext operation, once the ciphertext confusion data is received by the platform side communication unit, the ciphertext confusion data is homomorphic decrypted by using a decryption key to obtain plaintext confusion data, once the plaintext confusion data is received by the data application side communication unit, the plaintext confusion data is deconfused by using the random number to obtain plaintext data, so that the encryption and decryption platform as a third party cannot perceive the original content of the data in the process of decrypting the data of the data application party, and the security of data outsourcing encryption is greatly improved. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 is a structural block diagram of the homomorphic encryption-based ciphertext data outsourcing decryption system in the embodiment of the application;

[0026] Figure 2 is a structural block diagram of the data application party in the embodiment of the application;

[0027] Figure 3is a structure block diagram of a key management party in an embodiment of the present application;

[0028] Figure 4 is a structure block diagram of a decryption and encryption platform in an embodiment of the present application; and

[0029] Figure 5 is an action flowchart of a homomorphic encryption-based ciphertext data outsourcing decryption system decrypting ciphertext data in an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the technical means, creative features, purposes and effects of the present application easy to understand, the present application is specifically described below in combination with embodiments and drawings.

[0031] [EMBODIMENT]

[0032] Figure 1 is a structure block diagram of a homomorphic encryption-based ciphertext data outsourcing decryption system in an embodiment of the present application.

[0033] As shown in Figure 1 , in the present embodiment, the homomorphic encryption-based ciphertext data outsourcing decryption system 1000 is used for decrypting ciphertext data, and includes a data application party 100, a key management party 200, and a decryption and encryption platform 300.

[0034] The data application party 100 is in communication connection with the decryption and encryption platform 300 through a communication network 400, and the key management party 200 is in communication connection with the decryption and encryption platform 300 through a communication network 500.

[0035] Figure 2 is a structure block diagram of a data application party in an embodiment of the present application.

[0036] As shown in Figure 2 , the data application party 100 includes a data storage unit 101, a random number generation unit 102, a confusion unit 103, a de-confusion unit 104, a data application side communication unit 105, a data application side temporary storage unit 106, and a data application side control unit 107.

[0037] The data storage unit 101 stores ciphertext data to be decrypted, which is homomorphic encryption ciphertext data HE(data)k1 using an encryption key k1.

[0038] The random number generation unit 102 is used for generating a random number r.

[0039] The confusion unit 103 is used for performing additive confusion processing on the ciphertext data HE(data)k1 using the random number r based on the characteristic that homomorphic encryption can perform plaintext-ciphertext operation, to obtain ciphertext confusion data HE(data+r)k1.

[0040] The deobfuscation unit 104 is used to perform subtraction deobfuscation on the plaintext obfuscated data data+r using a random number r (i.e., data+rr) to obtain the plaintext data data, which is the plaintext data ultimately needed by the data application party 100.

[0041] The data application-side communication unit 105 is used for data exchange between the various components of the data application party 100 and between the data application party 100 and the encryption / decryption platform 300. For example, it sends ciphertext obfuscated data obtained by the obfuscation unit 103 to the encryption / decryption platform 300 and receives plaintext obfuscated data sent by the encryption / decryption platform 300. In this embodiment, the data application-side communication unit 105 uses an SSL (Secure Sockets Layer) secure channel to send the ciphertext obfuscated data to the encryption / decryption platform 300.

[0042] The data application side temporary storage unit 106 is used to temporarily store the data exchanged between the various components of the data application party 100 and between the data application party 100 and the encryption / decryption platform 300, including the ciphertext obfuscated data obtained by the obfuscation unit 103 and the plaintext obfuscated data received from the encryption / decryption platform 300.

[0043] The data application side control unit 107 is used to control the operation between the various components in the data application side 100.

[0044] Figure 3 This is a structural block diagram of the key management party in an embodiment of the present invention.

[0045] like Figure 3 As shown, the key management unit 200 includes a key generation unit 201, a key management side communication unit 202, a key management side temporary storage unit 203, and a key management side control unit 204.

[0046] The key generation unit 201 generates a decryption key k2 used for homomorphic decryption of the ciphertext obfuscated data HE(data+r)k1. In practical applications, for the purpose of decryption after encryption, the key generation unit 201 typically generates a key pair containing the encryption key k1 and the decryption key k2. If the key pair uses a symmetric key system, the encryption key k1 and the decryption key k2 are completely identical, i.e., k1 = k2; if the key pair uses an asymmetric key system, the encryption key k1 is the private key, and the decryption key k2 is the public key.

[0047] The key management side communication unit 202 is used for data exchange between the various components of the key management unit 200 and between the key management unit 200 and the encryption / decryption platform 300. For example, it sends the decryption key generated by the key generation unit 201 to the encryption / decryption platform 300. In this embodiment, the key management side communication unit 202 sends the decryption key to the encryption / decryption platform 300 using a key envelope.

[0048] The key management side temporary storage unit 203 is configured to temporarily store data exchanged between each component in the key management party 200 and between the key management party 200 and the encryption and decryption platform 300, including the decryption key k2 generated by the key generation unit 201.

[0049] The key management side control unit 204 is configured to control the operation of each component in the key management party 200.

[0050] Figure 4 is a structural block diagram of the encryption and decryption platform end in the embodiment of the present application.

[0051] As shown in Figure 4 The encryption and decryption platform 300 comprises a homomorphic decryption unit 301, a platform side communication unit 302, a platform side temporary storage unit 303, and a platform side control unit 304.

[0052] The homomorphic decryption unit 301 is configured to perform homomorphic decryption on the ciphertext obfuscated data HE(data+r)k1 using the decryption key k2 to obtain the plaintext obfuscated data data+r. All homomorphic encryption algorithms supporting plaintext and ciphertext calculation can be applied in the present embodiment, such as full homomorphism, semi-homomorphism, other algorithms with homomorphic properties, etc.

[0053] The platform side communication unit 302 is configured to exchange data between each component in the encryption and decryption platform 300, between the encryption and decryption platform 300 and the data application party 100, and between the encryption and decryption platform 300 and the key management party 200. For example, receiving the ciphertext obfuscated data sent by the data application party 100, receiving the decryption key sent by the key management party 200, and sending the plaintext obfuscated data obtained by the homomorphic decryption unit 301 to the data application party 100.

[0054] The platform side temporary storage unit 303 is configured to temporarily store data exchanged between each component in the encryption and decryption platform 300, between the encryption and decryption platform 300 and the data application party 100, and between the encryption and decryption platform 300 and the key management party 200, including the plaintext obfuscated data received from the data application party 100, the decryption key received from the key management party 200, and the plaintext obfuscated data obtained by the homomorphic decryption unit 301.

[0055] The platform side control unit 304 is configured to control the operation of each component in the encryption and decryption platform 300.

[0056] The operation process of the ciphertext data encryption by the plaintext data outsourcing decryption system 1000 based on homomorphic encryption will be described in detail in combination with the flowchart.

[0057] Figure 5This is a flowchart illustrating the decryption process of ciphertext data by an outsourced decryption system based on homomorphic encryption in an embodiment of the present invention.

[0058] like Figure 5 As shown, in this embodiment, the operation flow of the ciphertext data decryption system 1000 based on homomorphic encryption to decrypt ciphertext data includes the following steps:

[0059] Step S1: The random number generation unit 102 generates a random number r, and then proceeds to step S2.

[0060] In step S2, the obfuscation unit 103 uses a random number r to perform additive obfuscation on the ciphertext data HE(data)k1 based on the characteristic that homomorphic encryption can perform plaintext-ciphertext operations to obtain obfuscated ciphertext data HE(data+r)k1, and then proceeds to step S3.

[0061] In step S3, the data application side communication unit 105 sends the encrypted obfuscated data HE(data+r)k1 to the encryption / decryption platform 300, and then proceeds to step S4.

[0062] Step S4: Once the platform-side communication unit 302 receives the ciphertext obfuscated data HE(data+r)k1, the homomorphic decryption unit 301 uses the decryption key k2 to homomorphically decrypt the ciphertext obfuscated data HE(data+r)k1 to obtain the plaintext obfuscated data data+r, and then proceeds to S5.

[0063] In step S5, the platform-side communication unit 302 sends the plaintext obfuscated data data+r to the data application party 100, and then proceeds to step S6.

[0064] Step S6: Once the data application side communication unit 105 receives the plaintext obfuscated data data+r, the deobfuscation unit 104 uses a random number r to subtract the plaintext obfuscated data data+r to obtain the plaintext data data, and then enters the end state.

[0065] The role and effect of the embodiments

[0066] The homomorphic encryption-based ciphertext data outsourcing decryption system and method provided by the embodiment can use a random number to perform confusion processing on the ciphertext data to obtain ciphertext confusion data based on the feature that the confusion unit can perform plaintext-ciphertext operation based on homomorphic encryption. Once the platform-side communication unit receives the ciphertext confusion data, the homomorphic decryption unit uses a decryption key to perform homomorphic decryption on the ciphertext confusion data to obtain plaintext confusion data. Once the data application-side communication unit receives the plaintext confusion data, the de-confusion unit uses the random number to perform de-confusion processing on the plaintext confusion data to obtain plaintext data. In this way, the encryption and decryption platform as a third party cannot perceive the original content of the data in the process of decrypting the data of the data application party, thereby greatly improving the security of data outsourcing encryption.

[0067] The above embodiment is a preferred case of the present application and does not limit the protection scope of the present application.

[0068] For example, in the above embodiment, the outsourcing decryption system has a key management party that generates a decryption key used for homomorphic decryption processing on the ciphertext confusion data and sends the decryption key to the encryption and decryption platform. However, in the present application, the outsourcing decryption system can also not have a key management party. In this case, the encryption and decryption platform is provided with a key generation unit for generating a decryption key used for homomorphic encryption processing on the ciphertext confusion data.

[0069] For another example, in the above embodiment, the confusion unit in the data application party uses a random number to perform additive confusion processing on the ciphertext data to obtain ciphertext confusion data. Correspondingly, the de-confusion unit uses a random number to perform subtractive de-confusion processing on the plaintext confusion data to obtain plaintext data. However, in the present application, the confusion unit can also use a random number to perform subtractive confusion processing on the ciphertext data to obtain ciphertext confusion data. Correspondingly, the de-confusion unit uses a random number to perform additive de-confusion processing on the plaintext confusion data to obtain plaintext data. Alternatively, the confusion unit uses a random number to perform multiplicative or divisive confusion processing on the ciphertext data to obtain confusion data. Correspondingly, the de-confusion unit uses a random number to perform divisive or multiplicative de-confusion processing on the plaintext confusion data to obtain plaintext data. In summary, in the process of using a random number to perform confusion processing on the ciphertext data and de-confusion processing on the plaintext confusion data, the confusion operation method can adopt addition, subtraction, multiplication, or division, and the operation method for ciphertext de-confusion only needs to correspond to the operation method for confusion, that is, addition corresponds to subtraction, and multiplication corresponds to division.

Claims

1. A homomorphic encryption based ciphertext data outsourcing decryption system, characterized by, The system comprises: a data application party; and a decryption platform connected with the data application party through a communication network, wherein the data application party comprises a data storage unit, a random number generation unit, an obfuscation unit, a data application side communication unit and a de-obfuscation unit, the decryption platform comprises a platform side communication unit and a homomorphic decryption unit, the data storage unit stores ciphertext data homomorphically encrypted using an encryption key, the random number generation unit generates a random number, the obfuscation unit uses the random number to perform obfuscation processing on the ciphertext data to obtain ciphertext obfuscated data based on the characteristic that homomorphic encryption can perform plaintext-ciphertext operation, the data application side communication unit sends the ciphertext obfuscated data to the decryption platform, once the platform side communication unit receives the ciphertext obfuscated data, the homomorphic decryption unit uses a decryption key to perform homomorphic decryption on the ciphertext obfuscated data to obtain plaintext obfuscated data, the platform side communication unit sends the plaintext obfuscated data to the data application party, once the data application side communication unit receives the plaintext obfuscated data, the de-obfuscation unit uses the random number to perform de-obfuscation processing on the plaintext obfuscated data to obtain plaintext data.

2. The homomorphic encryption based ciphertext data outsourcing decryption system of claim 1, wherein, Further comprising: a key management party in communication connection with the decryption platform through a communication network, wherein the key management party comprises a key generation unit and a key management side communication unit, the key generation unit is used to generate the decryption key, the key management side communication unit sends the decryption key to the decryption platform.

3. The ciphertext data outsourcing decryption system based on homomorphic encryption according to claim 2, characterized in that: wherein the key management side communication unit sends the decryption key to the decryption platform in the form of a key envelope.

4. The ciphertext data outsourcing decryption system based on homomorphic encryption according to claim 1, characterized in that: wherein, the decryption platform further comprises a key generation unit, the key generation unit is used to generate the decryption key.

5. The ciphertext data outsourcing decryption system based on homomorphic encryption according to any one of claims 1-4, characterized in that: wherein, the homomorphic encryption is full homomorphic encryption or semi-homomorphic encryption.

6. The ciphertext data outsourcing decryption system based on homomorphic encryption according to any one of claims 1-4, characterized in that: wherein, the operation method of the obfuscation processing is addition, subtraction, multiplication or division, and correspondingly, the operation method of the de-obfuscation processing is subtraction, addition, division or multiplication.

7. The ciphertext data outsourcing decryption system based on homomorphic encryption according to any one of claims 1-4, characterized in that: wherein the data application side communication unit sends the ciphertext obfuscated data to the decryption platform through an SSL secure channel.

8. A homomorphic encryption based ciphertext data outsourcing decryption method, characterized by, The system comprises the following steps: generating a random number; using the random number to perform obfuscation processing on ciphertext data to obtain ciphertext obfuscated data based on the characteristic that homomorphic encryption can perform plaintext-ciphertext operation; sending the ciphertext obfuscated data to a decryption platform; once receiving the ciphertext obfuscated data, using a decryption key to perform homomorphic decryption on the ciphertext obfuscated data to obtain plaintext obfuscated data; sending the plaintext obfuscated data to a data application party; Once the plaintext obfuscated data is received, the plaintext obfuscated data is de-obfuscated using the random number to obtain plaintext data.

Images