Privacy-preserving image recognition method based on threshold Paillier cryptosystem

Abstract

The application discloses a privacy protection image recognition method based on a threshold Paillier cryptosystem, in the registration stage, the database mechanism divides the database into two parts horizontally after encrypting the database by rows, and sends the two parts to a server 1 and a server 2 respectively, the server 1 and the server 2 perform an offline preprocessing mechanism; in the recognition stage, a user encrypts a feature vector of an image to be recognized and generates a random number, sends the encrypted feature vector and the encrypted random number to the server 1, sends the encrypted feature vector to the server 2, the server 1 and the server 2 calculate square Euclidean distances and find minimum values in parallel, the server 1 performs masking and partial decryption on the results, the server 2 performs partial decryption and threshold decryption, and sends the results to the user; after obtaining the results returned by the server 2, the user uses the random number generated by the user to restore the results to obtain correct recognition results. The application can efficiently complete accurate recognition of privacy protection images.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of image recognition, and particularly to a privacy protection image recognition method based on a threshold Paillier cryptographic system. BACKGROUND

[0002] Privacy protection image recognition is a technology that aims to protect data privacy while achieving image recognition, and is widely used in fields with high security requirements. Furthermore, image recognition can be extended to other fields, such as face recognition. The core of image recognition technology lies in extracting unique features from images and then performing recognition through similarity measurement (such as Euclidean distance, cosine similarity). However, traditional image recognition technology usually requires the transmission of plaintext data to the cloud server for processing, which improves the recognition efficiency but also brings serious privacy risks.

[0003] In traditional image recognition systems, client devices are usually responsible for capturing images and sending these images or their feature vectors to the cloud server. The cloud server relies on powerful computing capabilities to perform recognition tasks and returns the results to the client. Such an architecture allows the client device to not bear a large amount of computing burden, and the recognition task can be efficiently completed on the cloud. However, in this process, data may face interception or leakage risks during transmission and storage, especially when sensitive data is involved. For example, in some sensitive application scenarios, unauthorized image leakage may lead to the leakage of personal or organizational privacy information, thereby threatening their security.

[0004] To solve the above privacy problems, privacy protection image recognition technology has emerged. This technology ensures that the cloud server cannot directly access the original data during image recognition through various encryption methods, thereby significantly reducing the risk of data leakage. The core of privacy protection image recognition technology lies in protecting image data privacy through homomorphic encryption, secret sharing, or differential privacy encryption methods.

[0005] Homomorphic encryption is an encryption technology that allows computation in ciphertext state, which means that the cloud server can directly process encrypted data without decrypting the data. Secret sharing technology is to divide data into multiple parts and store them on different servers, and only when these parts are combined together can the original data be reconstructed. Differential privacy introduces noise into data to make individual data points difficult to identify, thereby protecting individual privacy.

[0006] However, despite the great potential of privacy-preserving image recognition technology in privacy protection, current technical solutions still face some challenges. First, the computational complexity of homomorphic encryption is high, especially when dealing with large-scale data, the computational cost increases significantly. Although some solutions improve efficiency through batch computation, operations such as multiplication and minimum value are still time-consuming and expensive in the ciphertext state. This means that in practical applications, cloud servers need more computing power and more resources to perform these tasks.

[0007] Secondly, privacy-preserving image recognition technology has difficulties in balancing privacy protection and recognition accuracy. In order to enhance privacy protection, some solutions use approximate calculation or introduce noise into data. However, these measures inevitably reduce the accuracy of recognition. For example, differential privacy-based methods mask the true data by introducing noise, but this also affects the final recognition result, making it less accurate than when dealing with original data.

[0008] In addition, the actual deployment of privacy-preserving image recognition technology also faces operational challenges. In a multi-server architecture, the computing tasks between servers need to be coordinated, which may lead to waste of computing resources. For example, a server may need to wait for another server to complete the calculation before continuing the task, thereby reducing the efficiency of the overall system. Therefore, how to optimize the allocation of server computing capacity and improve resource utilization is also a problem that privacy-preserving image recognition technology needs to solve. SUMMARY

[0009] The purpose of the present application is to overcome the shortcomings of the prior art and provide a privacy-preserving image recognition method based on a threshold Paillier cryptosystem, which can efficiently complete the accurate recognition of privacy-protected images and has high reliability.

[0010] To achieve the above-mentioned purpose, the technical solution provided by the present application is: a privacy-preserving image recognition method based on a threshold Paillier cryptosystem, comprising the following steps:

[0011] In the registration phase, the database institution encrypts the database by row, then divides the encrypted database horizontally into two parts and sends them to server 1 and server 2 respectively, which are used for comparison with the image to be identified in the identification phase, and server 1 and server 2 perform offline preprocessing mechanism to pre-calculate the data needed in the identification phase, including encrypted random numbers and encrypted operators; wherein the database institution has a database containing a large number of image feature vectors, is responsible for key generation and distribution, and generates the public key pk and private key sk of the threshold Paillier cryptosystem and part of the private key sk1 and sk2, sends pk to the user, sends pk and sk1 to server 1, and sends pk and sk2 to server 2;

[0012] During the recognition phase, the user initiates a privacy-preserving image recognition task request, uses the public key pk to encrypt the feature vector of the image to be recognized and generates a random number, sends the encrypted feature vector and the encrypted random number to server 1, sends the encrypted feature vector to server 2, and then waits for server 2 to return the result; server 1 and server 2 parallelly calculate the squared Euclidean distance between the feature vector of the image to be recognized and the feature vectors of all images in their respective encrypted databases, and find the minimum value of the squared Euclidean distances in their respective parts. Subsequently, server 1 masks and partially decrypts the result, and server 2 performs partial decryption and threshold decryption and sends the result to the user; after obtaining the result returned by server 2, the user uses the random number generated by himself to restore the result to obtain the correct recognition result.

[0013] Furthermore, during the registration phase, the database mechanism encrypts the database to obtain an encrypted database. The encrypted database It consists of γ rows and n+1 columns, where γ represents the number of images and n represents the dimension of the feature vector. The encrypted database is divided into two parts by row level. If the number of rows in the two parts is the same, they are sent to server 1 and server 2 respectively. Otherwise, the part with smaller number of rows is sent to server 2, and the part with larger number of rows is sent to server 1. The encrypted database owned by server 1 is used Indicates that it is The encrypted database of server 2 consists of n rows and 1 columns. Indicates that it is Server 1 and Server 2 both generate a preset number of random numbers, pre-calculate some operators required for the subsequent recognition stage, and encrypt some random numbers or operators for direct use in the subsequent recognition stage.

[0014] Furthermore, the server 1 and the server 2 concurrently calculate the squared Euclidean distance between the feature vector of the image to be identified and the feature vectors of all images in the encrypted database that each server owns, including the following steps:

[0015] After receiving the encrypted feature vector sent by the user, Server 1 and Server 2 use homomorphic encryption to concurrently calculate the ciphertext of the difference between the encrypted feature vector and all vectors in their respective partially encrypted databases.

[0016] After Server 1 and Server 2 calculate the ciphertext of the difference, they execute the secure batch square protocol in parallel to calculate the ciphertext of the square of the difference.

[0017] After the server 1 and the server 2 calculate the ciphertext of the square of the difference, the ciphertext of the squared Euclidean distance is calculated in parallel, that is, for each vector, based on homomorphic encryption, all the ciphertext values of the vector are multiplied, that is, the ciphertext of the sum of the plaintext values is obtained.

[0018] Further, the server 1 and the server 2 find the minimum value in the respective part of the squared Euclidean distance they own, including the following steps:

[0019] After the server 1 and the server 2 calculate the ciphertext of the squared Euclidean distance between the encrypted feature vector of the image and all the vectors in the respective stored part of the encrypted database, the secure τ-minimum value protocol is executed in parallel, at this time τ=n, and the ciphertext of the minimum value in the respective squared Euclidean distance is found;

[0020] The server 2 sends its minimum value ciphertext to the server 1, and the server 1 takes its minimum value ciphertext, the minimum value ciphertext sent by the server 2, and the ciphertext of the set identification threshold as input, and with the assistance of the server 2, the secure τ-minimum value protocol is executed again, at this time τ=3, and the ciphertext of the global minimum value is obtained.

[0021] Further, the server 1 performs masking and partial decryption on the result, and the server 2 performs partial decryption and threshold decryption and sends the result to the user, including the following steps:

[0022] After the server 1 obtains the ciphertext of the global minimum value, the server 1 performs masking based on homomorphic encryption using the ciphertext of the random number sent by the user to obtain the ciphertext of the masking value;

[0023] The server 1 performs partial decryption on the ciphertext of the masking value to obtain the partial decryption ciphertext, and sends the ciphertext of the masking value and the partial decryption ciphertext to the server 2;

[0024] After the server 2 obtains the ciphertext of the masking value and the partial decryption ciphertext sent by the server 1, the server 2 performs partial decryption and threshold decryption to obtain the plaintext of the masking value, and the server 2 returns the plaintext of the masking value to the user.

[0025] Further, the secure batch squaring protocol includes the following steps:

[0026] The server 1 owns s ciphertexts Wherein, represents the i-th ciphertext, and the range of each plaintext is The constant L≥2 σ+2 , N and σ are security parameters, is a constant for controlling the size of the plaintext domain;

[0027] The server 1 generates s random numbers r i ←{0,1} σThe random number here can be generated in advance in the registration phase, based on homomorphic encryption, and the ciphertext is calculated where δ is a constant for converting negative numbers to non-negative numbers, The encrypted random number is calculated by the server 1 The multiple ciphertexts are packaged into one ciphertext, and then partial decryption is performed to obtain a partially decrypted ciphertext The server 1 sends and to the server 2;

[0028] After receiving and , the server 2 performs partial decryption and threshold decryption to obtain the plaintext C, and then calculates each plaintext where i ∈ [1, s], and after calculating the square of the s values, the s ciphertexts are sent to the server 1;

[0029] For i ∈ [1, s], the server 1 calculates the ciphertext and encrypts and 2δr i to obtain the encryption operator and and then calculates the ciphertext to obtain the ciphertext of .

[0030] Further, the secure τ-minimum value protocol includes the following steps:

[0031] The server 1 has τ ciphertexts where represents the τth ciphertext, and the range of each plaintext is is a constant for controlling the size of the plaintext domain;

[0032] Let the minimum value ciphertext be Control the loop variable t = 2;

[0033] When t ≤ τ, the server 1 and the server 2 perform a secure 2-minimum value protocol, assign the minimum value ciphertext to and t = t + 1, and the server 1 obtains the minimum value ciphertext

[0034] Further, the secure 2-minimum value protocol includes the following steps:

[0035] The server 1 has two ciphertexts and where the plaintext

[0036] The server 1 selects a random number pi in {0, 1} generated in advance in the registration stage, if pi = 0, the ciphertext is calculated If pi = 1, the ciphertext is calculated Wherein, N is a security parameter, R1, R2 are random numbers generated in advance in the registration stage, R1 <- {0, 1} σ \{0}, Then, the server 1 performs partial decryption to obtain Send To the server 2;

[0037] After the server 2 receives , the server 2 performs partial decryption and threshold decryption using And To obtain the plaintext D, if The ciphertext is calculated Otherwise, the ciphertext is calculated Wherein, r' is a random number generated in advance in the registration stage for refreshing the ciphertext, the server 2 sends To the server 1;

[0038] After the server receives , according to the value of pi generated by itself, the ciphertext of the minimum value result is calculated, if pi = 0, the minimum value ciphertext Otherwise,

[0039] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0040] 1. The present application is based on a threshold Paillier cryptosystem, and proposes an efficient and reliable privacy protection image recognition scheme, which supports efficient image recognition of double servers, does not disclose the privacy information of users, including image feature vectors and recognition results, and does not reduce the accuracy of recognition.

[0041] 2. The present application designs a series of secure outsourcing computing protocols, including secure batch squaring and secure minimum value protocol (i.e. secure tau-minimum value protocol and secure 2-minimum value protocol). The present application uses the proposed secure outsourcing computing protocol to support efficient ciphertext calculation in the privacy protection image recognition process.

[0042] 3. The present application uses a parallel computer mechanism to evenly distribute the database to the double servers, and the double servers perform the privacy protection image recognition task in parallel. In this task, each server needs to perform its own calculation task, while assisting another server to perform the secure computing protocol. The parallel computing mechanism used in the present application improves the efficiency and performance of the privacy protection image recognition.

[0043] 4、The application does not need the user to frequently interact with the server in the identification process, and the identification task can ensure high efficiency without reducing the accuracy of identification. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 The figure is a schematic diagram of the method of the application.

[0045] Figure 2 The figure is a relationship diagram between the database mechanism, the user, the server 1 and the server 2. DETAILED DESCRIPTION

[0046] The application will be further described in detail below in combination with the embodiments and the drawings, but the embodiments of the application are not limited thereto.

[0047] Referring to Figure 1 and Figure 2 , the embodiment discloses a privacy protection image identification method based on a threshold Paillier cryptosystem, comprising the following steps:

[0048] In the registration phase, the database mechanism divides the encrypted database into two parts horizontally after encrypting the database by rows, and sends the two parts to the server 1 and the server 2 respectively, which are used for comparison with the to-be-identified image in the identification phase, and the server 1 and the server 2 perform an offline preprocessing mechanism to pre-calculate the data needed in the identification phase, including an encrypted random number and an encrypted operator; wherein the database mechanism has a database containing a large number of image feature vectors, is responsible for the generation and distribution of keys, generates a public key pk and a private key sk of a threshold Paillier cryptosystem and part of the private keys sk1 and sk2, sends the pk to the user, sends the pk and the sk1 to the server 1, and sends the pk and the sk2 to the server 2;

[0049] In the identification phase, the user initiates a privacy protection image identification task request, encrypts the feature vector of the to-be-identified image using the public key pk (the user can obtain the picture of the to-be-identified image through a terminal device such as a camera, a mobile phone, etc., and extract the feature vector through a deep learning model) and generates a random number, sends the encrypted feature vector and the encrypted random number to the server 1, sends the encrypted feature vector to the server 2, and then waits for the server 2 to return the result; the server 1 and the server 2 calculate the squared Euclidean distance between the feature vector of the to-be-identified image and the feature vectors of all images in the part of the encrypted database that they own in parallel, find the minimum value in the part of the squared Euclidean distance that they own, then the server 1 performs masking and partial decryption on the result, the server 2 performs partial decryption and threshold decryption, and sends the result to the user; after obtaining the result returned by the server 2, the user restores the correct identification result using the random number generated by himself.

[0050] Specifically, in the registration phase, the database mechanism encrypts the database to obtain an encrypted database The encrypted database consisting of γ rows and n+1 columns, where γ represents the number of images and n represents the dimension of the feature vector; the encrypted database is divided into two parts horizontally by row, if the number of rows is consistent, the two parts are sent to server 1 and server 2 respectively, otherwise, the part with fewer rows is sent to server 2 and the part with more rows is sent to server 1, the part of the encrypted database owned by server 1 is represented by , which consists of rows and n+1 columns, and the part of the encrypted database owned by server 2 is represented by , which consists of rows and n+1 columns; both server 1 and server 2 generate a preset number of random numbers, pre-calculate the part of the operator needed in the subsequent identification phase (in the identification, secure batch square protocol, secure τ-minimum value protocol and secure 2-minimum value protocol are called, some random numbers and operators in these protocols can be pre-calculated here, and the operator can be understood as some constants or constants and random numbers), and encrypt part of the random numbers or operators, so that they can be directly used in the subsequent identification phase.

[0051] Specifically, the server 1 and server 2 calculate the squared Euclidean distance between the feature vector of the image to be identified and the feature vector of all images in the part of the encrypted database owned by each server in parallel, including the following steps:

[0052] After server 1 and server 2 receive the encrypted feature vector sent by the user, based on homomorphic encryption, the two servers calculate the ciphertext of the difference between the encrypted feature vector and all vectors stored in the part of the encrypted database owned by each server in parallel;

[0053] After server 1 and server 2 calculate the ciphertext of the difference, they execute the secure batch square protocol in parallel to calculate the ciphertext of the square of the difference;

[0054] After server 1 and server 2 calculate the ciphertext of the square of the difference, they calculate the ciphertext of the squared Euclidean distance in parallel, that is, for each vector, based on homomorphic encryption, all ciphertext values of the vector are multiplied to obtain the ciphertext of the sum of the plaintext values.

[0055] Specifically, the server 1 and server 2 find the minimum value in the part of the squared Euclidean distance owned by each server, including the following steps:

[0056] After server 1 and server 2 calculate the ciphertext of the squared Euclidean distance between the encrypted feature vector of the image and all vectors stored in the part of the encrypted database owned by each server, they execute the secure τ-minimum value protocol in parallel, where τ=n, to find the ciphertext of the minimum value in the squared Euclidean distance calculated by each server.

[0057] The server 2 sends the ciphertext of the minimum value of itself to the server 1, and the server 1 takes the ciphertext of the minimum value of itself, the ciphertext of the minimum value sent by the server 2 and the ciphertext of the set identification threshold as inputs, and performs the secure τ-minimum value protocol again with the assistance of the server 2, where τ = 3, to obtain the ciphertext of the global minimum value.

[0058] Specifically, the server 1 performs masking and partial decryption on the result, the server 2 performs partial decryption and threshold decryption, and sends the result to the user, including the following steps:

[0059] After the server 1 obtains the ciphertext of the global minimum value, the server 1 performs masking based on homomorphic encryption using the ciphertext of the random number sent by the user to obtain the ciphertext of the masked value;

[0060] The server 1 performs partial decryption on the ciphertext of the masked value to obtain the partially decrypted ciphertext, and sends the ciphertext of the masked value and the partially decrypted ciphertext to the server 2;

[0061] After the server 2 obtains the ciphertext of the masked value and the partially decrypted ciphertext sent by the server 1, the server 2 performs partial decryption and threshold decryption to obtain the plaintext of the masked value, and returns the plaintext of the masked value to the user.

[0062] Specifically, the secure batch squaring protocol includes the following steps:

[0063] The server 1 has s ciphertexts wherein, represents the i-th ciphertext, and the range of each plaintext is The constant L ≥ 2 σ+2 , N and σ are security parameters, is a constant for controlling the size of the plaintext domain;

[0064] The server 1 generates s random numbers r i ←{0,1} σ The random numbers can be generated in advance in the registration stage, and the ciphertext is calculated based on homomorphic encryption where δ is a constant for converting negative numbers to non-negative numbers, is the encrypted random number, and the server 1 calculates the ciphertext The multiple ciphertexts are packaged into one ciphertext, and then partial decryption is performed to obtain the partially decrypted ciphertext The server 1 sends and to the server 2;

[0065] After the server 2 receives and , the server 2 performs partial decryption and threshold decryption to obtain the plaintext C, and then calculates each plaintext Where i∈[1,s], calculate the square of these s values ​​and encrypt them. Send to server 1;

[0066] For i∈[1,s], server 1 calculates the ciphertext and encryption and 2δr i Get the encryption operator and Then calculate the ciphertext get ciphertext.

[0067] Specifically, the secure τ-minimum protocol includes the following steps:

[0068] Server 1 has τ ciphertexts in, Represents the τth ciphertext, and the range of each plaintext is A constant that controls the size of the plaintext field;

[0069] Let the minimum ciphertext Control loop variable t=2;

[0070] When t≤τ, Server 1 and Server 2 execute the secure 2-minimum protocol and assign the minimum ciphertext to And t=t+1, at the end of the cycle, server 1 obtains the minimum ciphertext

[0071] Specifically, the secure 2-min protocol includes the following steps:

[0072] Server 1 has two ciphertexts and The plain text

[0073] Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext is calculated. If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers generated in advance during the registration phase, R1←{0,1} σ \{0}, Then, Server 1 performs partial decryption to obtain Will Send to server 2;

[0074] Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext D. If Then calculate the ciphertext Otherwise, calculate the ciphertext Wherein, r' is a random number for refreshing the ciphertext generated in advance in the registration stage, the server 2 will Send to the server 1;

[0075] After the server receives According to the value of π generated by itself, the ciphertext of the minimum value result is calculated, if π=0, the minimum value ciphertext Otherwise,

[0076] To sum up, the application designs a series of secure outsourcing computing protocols, including a secure batch square protocol and a secure minimum value protocol (namely a secure τ-minimum value protocol and a secure 2-minimum value protocol), supports efficient ciphertext calculation in a privacy protection image recognition process, and uses a parallel computer mechanism, divides a database into two parts and stores them in double servers, and the double servers perform a privacy protection image recognition task in parallel, greatly improves the performance of the privacy protection image recognition.

[0077] The above embodiment is the preferred embodiment of the application, but the embodiment of the application is not limited by the above embodiment, and any change, modification, substitution, combination, simplification made without departing from the spirit and principle of the application should be an equivalent replacement method, which is included in the protection scope of the application.

Claims

1. A privacy-preserving image recognition method based on a threshold Paillier cryptosystem, characterized in that: The following steps are involved: During the registration phase, the database organization encrypts the database row by row and then horizontally divides the encrypted database into two parts, which are sent to server 1 and server 2 respectively for comparison with the image to be identified during the recognition phase. Server 1 and server 2 perform an offline preprocessing mechanism to pre-calculate the data required for the recognition phase, including encrypted random numbers and encryption operators. The database organization has a database containing a large number of image feature vectors and is responsible for key generation and distribution. The database organization generates the public key pk and private key sk of the threshold Paillier cryptosystem, as well as partial private keys sk1 and sk2, and sends pk to the user, pk and sk1 to server 1, and pk and sk2 to server 2. During the recognition phase, the user initiates a privacy-preserving image recognition task request, uses the public key pk to encrypt the feature vector of the image to be recognized and generates a random number, sends the encrypted feature vector and the encrypted random number to server 1, sends the encrypted feature vector to server 2, and then waits for server 2 to return the result. Servers 1 and 2 concurrently calculate the squared Euclidean distance between the feature vector of the image to be recognized and the feature vectors of all images in their respective encrypted databases, and find the minimum value of the squared Euclidean distances in their respective parts. Server 1 then masks and partially decrypts the result, while server 2 performs partial decryption and threshold decryption and sends the result to the user. After obtaining the result returned by server 2, the user uses the random number generated by himself to restore the result to obtain the correct recognition result. The server 1 and the server 2 concurrently calculate the squared Euclidean distance between the feature vector of the image to be identified and the feature vectors of all images in the encrypted database that each server owns, including the following steps: After receiving the encrypted feature vector sent by the user, Server 1 and Server 2 use homomorphic encryption to concurrently calculate the ciphertext of the difference between the encrypted feature vector and all vectors in their respective partially encrypted databases. After Server 1 and Server 2 calculate the ciphertext of the difference, they execute the secure batch square protocol in parallel to calculate the ciphertext of the square of the difference. After Server 1 and Server 2 calculate the ciphertext of the squared difference, they also calculate the ciphertext of the squared Euclidean distance in parallel. That is, for each vector, based on homomorphic encryption, all ciphertext values ​​of the vector are multiplied cumulatively to obtain the ciphertext of the sum of the plaintext values. The server 1 and the server 2 find the minimum value of the squared Euclidean distance of each server, including the following steps: After Server 1 and Server 2 calculate the ciphertext of the squared Euclidean distance between the encrypted feature vector of the image and all vectors in their respective partially encrypted databases, they execute the secure τ-minimum protocol in parallel, where τ = n, and find the ciphertext with the minimum squared Euclidean distance between them. Server 2 sends its own minimum ciphertext to Server 1. Server 1 uses its own minimum ciphertext, the minimum ciphertext sent by Server 2, and the ciphertext with the set recognition threshold as input. With the assistance of Server 2, Server 1 executes the secure τ-minimum protocol again, with τ = 3, to obtain the ciphertext with the global minimum. The server 1 masks and partially decrypts the result, the server 2 performs partial decryption and threshold decryption, and sends the result to the user, including the following steps: After obtaining the ciphertext of the global minimum value, Server 1 uses the random number ciphertext sent by the user and performs masking based on homomorphic encryption to obtain the masked value ciphertext; Server 1 performs partial decryption on the masked ciphertext to obtain a partially decrypted ciphertext, and sends the masked ciphertext and the partially decrypted ciphertext to Server 2. After server 2 obtains the masked value ciphertext and partially decrypted ciphertext sent by server 1, it performs partial decryption and threshold decryption to obtain the masked value plaintext, and server 2 returns the masked value plaintext to the user.

2. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 1, characterized in that: During the registration phase, the database organization encrypts the database to obtain an encrypted database. The encrypted database Depend on It consists of n rows + 1 columns, where Indicates the number of images, n indicates the dimension of the feature vector; the encrypted database is divided into two parts by row level. If the number of rows in the two parts is the same, they are sent to server 1 and server 2 respectively. Otherwise, the part with smaller number of rows is sent to server 2, and the part with larger number of rows is sent to server 1. The encrypted database owned by server 1 is used Indicates that it is The encrypted database of server 2 consists of n rows and 1 columns. Indicates that it is Server 1 and Server 2 both generate a preset number of random numbers, pre-calculate some operators required for the subsequent recognition stage, and encrypt some random numbers or operators for direct use in the subsequent recognition stage.

3. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 1, characterized in that: The secure batch square protocol comprises the following steps: Server 1 has s ciphertexts in, Represents the i-th ciphertext, and the range of each plaintext is (-2 l ,2 l ), Constant L ≥ 2 σ+2 , N and σ are security parameters, l is a constant that controls the size of the plaintext field; Server 1 generates s random numbers r i ←{0,1} σ , where the random number can be pre-generated during the registration phase, based on homomorphic encryption, to calculate the ciphertext Where δ is a constant that converts negative numbers to non-negative numbers, To encrypt the random number, Server 1 calculates the ciphertext Pack multiple ciphertexts into one ciphertext, and then perform partial decryption to obtain the partially decrypted ciphertext Server 1 will and Send to server 2; Server 2 receives and After that, perform partial decryption and threshold decryption to get the plaintext C, and then calculate each plaintext Where i∈[1,s], calculate the square of these s values ​​and encrypt them. Send to server 1; For i∈[1,s], server 1 calculates the ciphertext and encrypt-r i 2 and 2δr i Get the encryption operator and Then calculate the ciphertext get ciphertext.

4. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 1, characterized in that: The safety τ - The minimum protocol includes the following steps: Server 1 has τ ciphertexts in, Represents the τth ciphertext, and the range of each plaintext is (-2 l ,2 l ), l is a constant that controls the size of the plaintext field; Let the minimum ciphertext Control loop variable t=2; When t≤τ, Server 1 and Server 2 execute the secure 2-minimum protocol and assign the minimum ciphertext to And t=t+1, at the end of the cycle, server 1 obtains the minimum ciphertext 5. The privacy-preserving image recognition method based on the threshold Paillier cryptographic system according to claim 4, characterized in that: The secure 2-min protocol comprises the following steps: Server 1 has two ciphertexts and Where the plaintext x,y∈[-2 l ,2 l ]; Server 1 selects a random number π∈{0,1} generated in advance during the registration phase. If π=0, the ciphertext is calculated. If π=1, then calculate the ciphertext Among them, N is the security parameter, R1 and R2 are random numbers generated in advance during the registration phase, R1←{0,1} σ \{0}, Then, Server 1 performs partial decryption to obtain Will Send to server 2; Server 2 receives After that, use and Perform partial decryption and threshold decryption to obtain plaintext D. If Then calculate the ciphertext Otherwise calculate the ciphertext Among them, r' is the random number pre-generated during the registration phase for refreshing the ciphertext. Server 2 will Send to server 1; Server 1 receives Then, according to the value of π generated by itself, calculate the ciphertext of the minimum result. If π=0, the minimum ciphertext otherwise,

Images